malicious-software-packages-dataset · Index

2025-01-26-@optimystic99_dev-utils v1.0.9 Apr 24 malicious-software-packages-dataset

a636deefbdace2680b21e8a0f216b2702d462a5d22a4613e0c7e0400a979b832 O₂(AsS₄)H₅(Cm₆CrDb₈F₃Po)Md(Pa₃)

100% postinstall pipes curl to node

2026 01-08-chai-as-executed-v2.3.3 Apr 24 malicious-software-packages-dataset

b9bd0a1043cd89363e311ec5a850dfeb810d2ae78ea817e7ee58598221827b35 K₂(McLi)O₃(C₃As₂S)H₅(Cm₉Db₈Os₂Po₈Ti)Md₄(InLiPa₃)

100% Remote code execution via base64

2025-01-31-@optimystic99_dev-utils v1.0.15 Apr 24 malicious-software-packages-dataset

c127f3730ba11825a08d4dc8458323e9a7a7bdb7dd98cebeae73b6391c1e9bd6 O₂(AsS₄)H₄(Cm₅CrDb₈F₃)Md(Pa₃)

100% postinstall pipes curl to node

2025-12-20-@ikarem_telemetry v100.1.9 Apr 24 malicious-software-packages-dataset

d6b1a315fc837934302f71ed169f31dc4f3c27a45442c00c55f0e45198849b0f O(S₃)H₃(Cm₂Db₄Os₃)Md(Pa₇)

100% Supply chain attack with install hooks

2025 08-23-xpoc-ts-lib-v99.0.9 Apr 24 malicious-software-packages-dataset

e12f8a8df11b6bc69a554f89665167882b02cc07a54f6f4367e6ed793ef6ce7e O₂(S₈Eu)H₃(CmDb₂Po)Md(Pa₅)

100% Exfiltrates /etc/passwd via preinstall

2025-08-22-@google_cloud_common v20.1.1 Apr 24 malicious-software-packages-dataset

e15750685ab6bb3c8dfdd6bb5b3c73cbae989cb8cb03f7bd35dee0714d7a55cf O₂(S₄Eu)H₄(CmDb₂Os₂Po₂)Md(Pa)

100% postinstall exfiltrates env and commands

2025 11-03-lowerx-package-v1.0.2 Apr 24 malicious-software-packages-dataset

ee01335d6c9241cbb2a845e08c078632f0acf8cbdd19f55160a517f4999e01b8 O₃(EuS₄Dy₂)H₆(Cm₄Cr₂Db₅F₂OsPo₃)Md₂(InPa₂)

100% preinstall exfiltrates system info

2025-01-28-@optimystic99_dev-utils v1.0.10 Apr 24 malicious-software-packages-dataset

f0c433863aec77720372c70de5d9ba696d9832aeed8e73a60a60796634a6ede9 O₂(AsS₄)H₅(Cm₆CrDb₈F₃Po)Md(Pa₃)

100% postinstall pipes curl to node

2025 01-18-trigger-gitlab-pipeline-v1.1.0 Apr 24 malicious-software-packages-dataset

f19795241a284333236b19a482864392a90f08479855d9d8f4ec07f20eecc2ce O₄(Eu₃S₈Dy₃C)H₅(Cm₆Db₂F₃Os₂Po₃)Md₂(InPa₂)

100% Exfiltrates system data to OOB

2025-12-21-@ikarem_telemetry v100.1.11 Apr 24 malicious-software-packages-dataset

f918c11465324bd46caac9df1efdb99853a10bf9c84fa7d7aa7f4352407cda40 O₂(S₇As)H₄(Cm₃Db₄OsPo)Md(Pa₇)

100% Preinstall exfiltrates system info to ngrok

2025-12-21-@ikarem_telemetry v100.1.10 Apr 24 malicious-software-packages-dataset

fa27b4af3607cac4812a2aa434e7c4ff3836e5274e21a53fa4d671cf77688f2a O₂(S₃As)H₄(Cm₃Db₄OsPo)Md(Pa₇)

100% Exfiltrates system info via install hooks

2025-01-31-@optimystic99_dev-utils v1.0.12 Apr 24 malicious-software-packages-dataset

fff1014004f1653310b1f3f95b090c21f50adfc6b4773b55e0c8b1ed7c7dacee O₂(AsS₄)H₄(Cm₆CrDb₈F₃)Md(Pa₃)

100% postinstall pipes curl to node

2025 08-08-erification-v1.0.0 Apr 24 malicious-software-packages-dataset

1dcadad7f91b9ca3c82ef7d917e9a6f2a9955bde9c5e1835f204b831eb0a7133 O₃(AsC₃Ca)H₅(Cm₆Db₆OsPoU₇)Md(Pa₄)

100% Phishing kit with credential theft

2025 07-28-udn_extras-v9999.0.0 Apr 24 malicious-software-packages-dataset

18df900598f16ce9b213c0be58bc5cffff4f264da0d1f5cb827ba5b540dd623b O₄(Eu₃S₆Dy₂C)H₄(Cm₆Db₃Os₄Po₂)Md₂(Pa₃In)

100% Exfiltrates system info to webhook.site

2025 07-02-shared-workflows-v1.0.0 Apr 24 malicious-software-packages-dataset

3772e9b572efc655aa47365798d803cb58bcd8eef0e122ee322dbbd7c1b54c9b O(S)H(Db₂)Md(Pa)

68% Encrypted archive members

2025 10-11-baidu-tims-v1.0.3 Apr 24 malicious-software-packages-dataset

3d60a62c6fe88b34a6ef4f3a1799c2c885fbef76fc444922ddfd89655cff3b6f O(S₅)H₃(CmDb₂Po₂)Md₂(InPa₃)

100% Exfiltrates environment variables via curl

2025 10-11-baidu-tims-v1.0.6 Apr 24 malicious-software-packages-dataset

7906514ea382062736e9f82931fc6603a3eb6bd2ed2a8590bf1fedd627b6562c O(S₅)H₃(CmDb₂Po₂)Md₂(InPa₃)

100% SSRF exfil via curl hooks

2026 02-23-uxproject11-v1.0.0 Apr 24 malicious-software-packages-dataset

888077d216566de5ef434764475bbc5903c4a5ff62faa4e5d044862a223b819f O₄(Eu₃S₇Dy₃C)H₅(Cm₇Db₅FOs₂Po₂)Md₃(Bk₂InPa₆)

100% Exfiltrates system info to OOB

2025 11-23-com.unity.xr.visionos-v2.3.2 Apr 24 malicious-software-packages-dataset

8ddf74b9d93b8456d59b27be46b36266530ab21b43d3d82cdbea414d93c0596b O₄(Eu₃S₉Dy₃C)H₅(Cm₆Db₂F₃Os₂Po₃)Md₂(InPa₂)

100% Exfiltrates system data to OOB

2025 10-11-baidu-tims-v1.0.4 Apr 24 malicious-software-packages-dataset

937d249c7f8a5e57d8047651f823447975635f3b3396e243f480eef0ed3ba629 O(S₅)H₃(CmDb₂Po₂)Md₂(InPa₃)

100% Exfiltrates environment variables via curl

2026 01-23-com.unity.xr.visionos-v2.3.1 Apr 24 malicious-software-packages-dataset

a3a10fb95976f8fc2129c6ed14d1a33c563775369b9a7e6c7d7c7bfc037b8350 O₅(Ca₂Eu₂S₅CXe)H₆(Cm₁₃Db₆F₄Os₅Po₆Ti)Md₃(InPa₂)

100% Credential exfiltration via install hooks

2025 10-11-baidu-tims-v1.0.2 Apr 24 malicious-software-packages-dataset

cb3ffeadba6cc84b4f75fcc045465f6ebb769e6de6786374a73bfeb05bce5dab O₂(C₂S₅)H₃(Cm₂Db₂Po₃)Md₂(InPa₃)

100% Reverse shell and C2 beacon

2025 06-29-titan-exchange-shared-v99.99.9 Apr 24 malicious-software-packages-dataset

ddfdab4b9c244f92dd71b44c04a4f745d7a37e4a1395c1a95d801bfb5fda63e3 O₂(S₈Eu)H₃(CmDb₃Po)Md(Pa₅)

100% preinstall exfiltrates system info

2025 06-25-vite-meta-plugin-v0.0.2 Apr 24 malicious-software-packages-dataset

f1fd48b91e919cd73895c5489b4f3a4977ca8e381c5abcc274bb0800a7744c35 K(Mc)O₂(S₂Dy₂)H₆(Cm₁₀Db₃F₂Os₄Po₃U)Md(Pa₃)

99% Remote code execution via eval

2025 08-17-commonweb-flow-v10.14.0 Apr 24 malicious-software-packages-dataset

1855f0569cc6c2cf7793d4254f18e05ae2995c69130b578a7a05a05d58e95759 O(S₆)H₂(Db₂Po)Md(Pa₄)

100% Preinstall exfiltrates system info

2025 08-17-commonweb-flow-v10.15.0 Apr 24 malicious-software-packages-dataset

11a9365b4ae71f8583250f1c251f9708e3442f049e95c221d6e605f749ee849c O₂(S₇Eu)H₂(Db₂Po)Md(Pa₄)

100% Preinstall exfiltrates system info to OAST

2025 08-23-knowpro-test-v99.0.9 Apr 24 malicious-software-packages-dataset

1467e973a73c953d466d882fa91a792f5f79d5f739f07b29885fd6ffb0af7209 O₂(S₈Eu)H₃(CmDb₂Po)Md(Pa₆)

100% Exfiltrates /etc/passwd via preinstall

2025 02-06-sally-fn-v69.0.0 Apr 24 malicious-software-packages-dataset

228b98cd6601e0868492be1f8ae0509915d990616937b9d376cb2377ee04cabc O₄(Eu₄S₇Dy₃C)H₄(Cm₅Db₃Os₂Po₃)Md₂(InPa₃)

100% Exfiltrates system info to OOB domain

2025 02-06-sally-fn-v70.0.0 Apr 24 malicious-software-packages-dataset

2aed879736dc22dfb7046acbd8b0c234e01bee0f904ba9478c73e3280071e9b8 O₄(Eu₃S₇Dy₃C)H₄(Cm₅Db₃Os₂Po₃)Md₂(InPa₃)

100% Exfiltrates system info to OOB endpoint

2025 08-30-decoupled-local-node-rig-v9.1.1 Apr 24 malicious-software-packages-dataset

3ab083bffa78007c6f63d676766aef5c78e87c2d041b2a37a53bf0a85243da52 O₃(Eu₄S₉Dy₄)H₄(Cm₈Db₃Os₄Po₄)Md₂(InPa₂)

100% Exfiltrates system data to OOB domain

2025 02-07-sally-fn-v72.0.0 Apr 24 malicious-software-packages-dataset

44d8e5b7a9b4a2e6c5cf4fb88c1ff91a7893f372e7b957b9cc37b9d4df80dd45 O₄(Eu₃S₇Dy₃C)H₄(Cm₆Db₃Os₂Po₃)Md₂(InPa₃)

100% Exfiltrates system info to OOB

2025 03-31-earthdata-search-v5.0.0 Apr 24 malicious-software-packages-dataset

6f1dd22779dc66bc84bde269e14cf8570a359f09a0cfe4934880cccadb26d142 O₄(Eu₃S₃Dy₃C)H₄(Cm₅Db₃Os₂Po₂)Md₂(InPa₂)

100% Exfiltrates system info to OOB domain

2026 03-02-chai-sync-v1.1.9 Apr 24 malicious-software-packages-dataset

67dfef2243611a4b9aa361f6f43507f061774b309cdb6d5502badf0d8719e6fa K₂(McLi)O₃(C₃As₂S)H₅(Cm₉Db₈Os₂Po₈Ti)Md₄(InLiPa₃)

100% Remote code execution via atob

2025 10-01-trendwatch-v30.2.1 Apr 24 malicious-software-packages-dataset

6b0ca97c6cb066c2d89ef06675d60cf03c8836c0f9b42d7a7475c1730cc7359f K(Am)O₃(Eu₂S₅Ca)H₅(Cm₆Db₃F₂Os₃Po₄)Md₃(InPa₂)

100% Exfiltrates system data to Discord

2026 01-27-cowsay-caps-v1.0.2 Apr 24 malicious-software-packages-dataset

742cce63e734a11b4906e8a514a77ed5db04fd76f9c2149ae39c34a0a9cbac72 O₂(S₂Eu)H₄(Cm₅Db₃OsPo)Md(In)

98% Exfiltrates args to external webhook

2025 11-06-gibertserctf3-v0.30.1 Apr 24 malicious-software-packages-dataset

7eb230aad97ad759890035406b4e7ae10293ef0e3be41e2f00ff5f01147b1fe9 O(S)H₄(CmDb₂F₂Po)Md(Pa₂)

91% preinstall hook reads /etc/passwd

2025 06-14-typescript-aurelia-api-v1.0.0 Apr 24 malicious-software-packages-dataset

9e60618494fe2ce38d870dcdd20279048837f78f0ef809a5344334b3953913f9 O₄(Eu₃S₈Dy₃C)H₅(Cm₆Db₂F₃Os₂Po₃)Md₂(InPa₃)

100% Exfiltrates system data to OOB endpoint

2025 10-01-trendwatch-v30.1.1 Apr 24 malicious-software-packages-dataset

a9918dfb5b2b3d5e2e14db1cc0054a3423676f1ef2b26512d78e4eba944dd492 K(Am)O₂(S₅Eu)H₅(Cm₉Db₃F₂Os₄Po₆)Md₃(InPa)

100% Exfiltrates system info to Discord

2025 02-06-sally-fn-v71.0.0 Apr 24 malicious-software-packages-dataset

c0875240527521aa6e2d7ede2f15f72cf23c76e10e03aef1fc337060f4593ca1 O₄(Eu₃S₈Dy₃C)H₄(Cm₆Db₃Os₂Po₃)Md₂(InPa₃)

100% Exfiltrates system info to OOB

2025-09-30-@testcarrot_supply7 v1.0.2 Apr 24 malicious-software-packages-dataset

db26e2ad0f9257244ab8d5f6f4850d87a0d890c5584503c7e85b505150e36931 O(S₃)H₅(CmDb₄FOs₂Po₃)Md₂(In)

100% Remote code execution backdoor

2025 08-17-commonweb-flow-v10.12.0 Apr 24 malicious-software-packages-dataset

dcff2da4f62a3d49644502349c12117097049f6785107468eaaa8c53cb304d97 O(S₆)H₂(Db₂Po)Md(Pa₄)

100% Preinstall exfiltrates system info

2025 08-23-decoupled-local-node-rig-v99.0.9 Apr 24 malicious-software-packages-dataset

e4f8d8a6470b6e94dab64e47d92620a973801d8aa6a97965f02c46329dc1d50a O₂(S₈Eu)H₃(CmDb₂Po)Md(Pa₅)

100% Exfiltrates /etc/passwd via preinstall

2026 01-27-cowsay-caps-v1.0.1 Apr 24 malicious-software-packages-dataset

f29e36f3fad44b3131cd027e951b8b57791f19e82c7b0ac6744df1c72f5c758e O₃(S₂CEu)H₄(Cm₄Db₃OsPo)Md(In)

99% Exfiltrates credentials to external webhook

2025 06-29-jsmdc-v99.99.2 Apr 24 malicious-software-packages-dataset

00574a52641ac32d817c36f6d9e894a795f5fd93ab28f08e2b8f8afa4a3ada12 O(S₈)H(Db₃)Md(Pa₅)

100% Exfiltrates system info via install hooks

2025 10-10-my-unique-package-here-v1.0.12 Apr 24 malicious-software-packages-dataset

07d09845eff01eac8753e440935ab7c30e21fe8f56fb5ea597a3bb636409881b K(Mc)O₂(S₃Eu)H₄(Cm₂Db₃Os₂Po₂)Md₂(InPa₄)

100% DNS exfiltration via preinstall hook

2024 07-12-discord-api-ts-v4.6.7 Apr 24 malicious-software-packages-dataset

083c54e03d23f8f409f9b74b6848a87afc3bf19774b946f6dbfce59b7b1210b9 K(Li)O₃(S₄As₄Ca)H₆(Cm₁₆CrDb₁₀F₃Os₂Po₂)Md₃(Bk₃Pa₆)

97% Obfuscated postinstall exfiltrates data

2025 10-11-my-unique-package-here-v1.0.14 Apr 24 malicious-software-packages-dataset

1424cdcaac4c2c38026039a50b0f07d0b0cad24b05e1543b83d7b7790807ff27 K(Mc)O₂(S₃Eu)H₃(CmDb₂Po₂)Md₂(InPa₃)

100% preinstall hook exfiltrates data

2025 10-11-my-unique-package-here-v1.0.15 Apr 24 malicious-software-packages-dataset

14eb107ad2d8964854aa709ddc2870b769f50165cdeb9b022b4b160096d2afb7 K(Mc)O₂(S₃Eu)H₃(CmDb₂Po₂)Md₂(InPa₃)

100% preinstall hook, OOB exfil, known malicious author

2025 10-10-my-unique-package-here-v1.0.10 Apr 24 malicious-software-packages-dataset

3101f5e7dab16574b7ec50625bfd37de221e2d5097d5bec92f4dd2a6ff3730e6 K(Mc)O₂(S₃Eu)H₃(Cm₂Db₂Po₂)Md₂(InPa₄)

100% preinstall curl to OOB domain

2025 10-10-my-unique-package-here-v1.0.11 Apr 24 malicious-software-packages-dataset

334976d14556818b39d507bd680f7a5ce261b8fc02543ed7a75bb0f6e5f40a2d K(Mc)O₂(S₃Eu)H₄(Cm₂Db₃Os₂Po₂)Md₂(InPa₄)

100% preinstall hook exfiltrates hostname

2025 10-11-my-unique-package-here-v1.0.17 Apr 24 malicious-software-packages-dataset

61f5832f2c49fc1c7f2cf660565c26bdcaa59be3b7e6fcf9c66b74de4849fd3b K(Mc)O₃(S₃CEu)H₃(Cm₂Db₂Po₂)Md₂(InPa₃)

100% Reverse shell and OOB exfiltration

2025 08-01-cerberux-v3.0.0 Apr 24 malicious-software-packages-dataset

6724b31ada3cc9909aa02766132916393b8f3be8dd23b08efc1828cb5c6c8d15 O₂(S₇Eu)H₃(Cm₂Db₂Po₂)Md₂(Pa₂In)

100% Exfiltrates system info via OAST

2025 10-11-my-unique-package-here-v1.0.21 Apr 24 malicious-software-packages-dataset

9da37eeb50912482f9a2b2f7fa1f240527670fed808b1050d0c68588648d3135 K(Mc)O₂(S₃Eu₂)H₃(Cm₂Db₂Po₂)Md₂(InPa₃)

100% Malicious npm package with exfiltration

2025 10-11-my-unique-package-here-v1.0.22 Apr 24 malicious-software-packages-dataset

a4ae7bfca71477c7057563e53c1bd674df63872e93e840400905d65df21df6d8 K(Mc)O₂(S₃Eu₂)H₃(Cm₂Db₂Po₂)Md₂(InPa₃)

100% Malicious npm package with exfiltration

2025 10-10-my-unique-package-here-v1.0.0 Apr 24 malicious-software-packages-dataset

a72d9fa041a8f6de8068bc3861d9477f19f85a7a19ae38c32fd6a27acd84b120 O(S)H(Db₂)Md(Pa)

67% Encrypted archive members

2024 12-12-test-paypal-v999.9.9 Apr 24 malicious-software-packages-dataset

c17deab495effbd0109fdf6d35ed903b696ad04af0898267a47648a1eaad69e8 H(Db₂)Md(Pa₄)

98% Encrypted archive, fake version

2025 10-21-infobip-calls-showcase-v1.0.1 Apr 24 malicious-software-packages-dataset

c636c96bc1ff4fd32023bf191ca22e57b4a74cd2f75269f9b040ba267eb7bbff O(S₇)H(Db₂)Md(Pa₃)

100% preinstall exfiltrates system info

2025 10-11-my-unique-package-here-v1.0.20 Apr 24 malicious-software-packages-dataset

d0cc5ca4a578dca2a412ca65a206c574408b21e44574c01966edd7f919998cf2 K(Mc)O₃(C₃S₃Eu)H₃(Cm₅Db₂Po₆)Md₂(InPa₃)

100% Reverse shell and data exfiltration

2025 10-02-ven0m90test1-v1.0.0 Apr 24 malicious-software-packages-dataset

f4210474b13a9205e2501c38a5c0473c1a1c0c9546b2c43e5dd3538580968b7d O₄(Eu₂Dy₃S₆C)H₄(Cm₃Db₄Os₄Po₃)Md₂(InPa₂)

100% Exfiltrates system info to OOB

2025 10-11-my-unique-package-here-v1.0.19 Apr 24 malicious-software-packages-dataset

d51319f37cd89abdd0ac20e824bf0583f5a435ebda6989eb4cb9318d51f7680e K(Mc)O₃(C₃S₃Eu)H₃(Cm₅Db₂Po₆)Md₂(InPa₃)

100% Reverse shell and C2 beaconing

2025 10-10-my-unique-package-here-v1.0.13 Apr 24 malicious-software-packages-dataset

f7035822a4ada2f787ccb2ba02915eaa2d3ff1f988e69371e1a428948f693785 K(Mc)O₂(S₃Eu)H₄(Cm₂Db₃Os₂Po₂)Md₂(InPa₄)

100% preinstall exfiltrates hostname to OOB

2025-03-27-@sporta-technology_d11-web-components.icon-element v0.0.9999 Apr 24 malicious-software-packages-dataset

0a2230c643f67fce8e02ba8dee468d3796b2b57aa7ce3c8f993ce682e63d7648 O(S₆)H(Db₂)Md(Pa₂)

100% preinstall exfiltrates system info

2026 02-21-securegate-cli-tool-v2.1.0 Apr 24 malicious-software-packages-dataset

1b97ccbb42495d6dbc57e37535d0326f6e421611348811c1e457bfb797579e0c K₂(AmLi)O₃(Eu₂Dy₃S₂)H₇(Cm₂₇CrDb₈F₈Os₆Po₃U₂)Md₃(InPa₂)

100% Malicious npm package with postinstall

2026 02-21-securegate-cli-tool-v2.1.2 Apr 24 malicious-software-packages-dataset

43501b67b49c84efe6f5a394fd1ef0a73dfddb65816b504ca11a3eb87799768f K₂(AmLi)O₃(Eu₂Dy₃S₂)H₇(Cm₂₇CrDb₈F₈Os₆Po₃U₂)Md₃(InPa₂)

100% Device fingerprinting, hidden config, malicious dataset

2025 02-10-asdasd-ejansan-nsjansna-v1.1.0 Apr 24 malicious-software-packages-dataset

5778a32fbc2c54e36ebf9f69ff487a02a7090ecea27d7ce9d73d2c24a6cd3687 O(S)H₄(Cm₉Db₂OsPo)

83% Exfiltrates user data to hardcoded IP

2026 02-22-securegate-cli-tool-v2.1.5 Apr 24 malicious-software-packages-dataset

615d6a3c1bd42504dd9a4797ee52e2028a9b5c1944e8e1cb6c7d109eee86c242 K₂(AmLi)O₃(Eu₂Dy₃S₂)H₇(Cm₂₇CrDb₈F₈Os₆Po₃U₂)Md₃(InPa₂)

100% Comprehensive system fingerprinting and exfiltration

2026 03-01-securegate-cli-tool-v2.1.6 Apr 24 malicious-software-packages-dataset

720d3c2294bf99aa72bb6ffe9e8fac3b18082aab790f6904f5b0c5a25e083d29 K₂(AmLi)O₃(Eu₂Dy₃S₂)H₇(Cm₂₇CrDb₉F₈Os₆Po₃U₂)Md₃(InPa₂)

100% postinstall copies to OpenClaw config

2026 02-21-securegate-cli-tool-v2.1.3 Apr 24 malicious-software-packages-dataset

741cfca08f3a9795ef5940fe2ab12ace4cc53c7e7d99620813ae7512b9e50d8f K₂(AmLi)O₃(Eu₂Dy₃S₂)H₇(Cm₂₇CrDb₈F₈Os₆Po₃U₂)Md₃(InPa₂)

100% Device fingerprinting, hidden config, postinstall

2026 02-19-securegate-cli-tool-v2.0.4 Apr 24 malicious-software-packages-dataset

75e3f58441f6fb90cf76b2e5b60c4ca7ea3eebb013c5b9488e709537156cd6ea K₂(AmLi)O₄(Eu₂Dy₃S₂C)H₇(Cm₂₀CrDb₈F₈Os₆Po₃U)Md₃(InPa₂)

100% postinstall drops agent skill file

2024 12-14-000webhost-cache-v999.9.9 Apr 24 malicious-software-packages-dataset

8ce820806900a3730c9c2af29918c70a4bd94551580f8dbfe1e9cf20cd4c2456 O₃(S₇DyEu)H₄(Cm₇Db₄Os₂Po₂)Md₂(Pa₄In)

100% DNS exfiltration via Oastify

2025 07-22-pre-and-postinstall-scripts-example-v7.0.0 Apr 24 malicious-software-packages-dataset

947108ca756ffb5b7bf28fa886644b2e247a3f3ddcd23795dd1c3b123dfd505e O₄(Eu₃S₇Dy₃C)H₄(Cm₄Db₄Os₂Po₂)Md₂(InPa₄)

100% Exfiltrates system info to OOB

2025-08-14-@azix058_design-system v10.0.0 Apr 24 malicious-software-packages-dataset

afa79a8896a0a598c875c6a77736961a704dcea775e48b95e304e11a88efc0c3 O₂(S₈Eu)H₃(CmDb₂Po)Md(Pa₂)

100% postinstall exfiltrates to OAST

2026 02-19-securegate-cli-tool-v2.0.0 Apr 24 malicious-software-packages-dataset

b693d1435107b2bbca65e5acbcf2622ed1eae28826b749e0c9ae748821c52a23 K₂(AmLi)O₃(Eu₂Dy₃S₂)H₇(Cm₂₀CrDb₈F₈Os₆Po₃U)Md₃(InPa₂)

100% Postinstall drops agent skill file

2025 06-29-sizings-v99.99.2 Apr 24 malicious-software-packages-dataset

c67cd5fb351d2d0bae169ecd5da4840eb415e53e02e20a348b62f492f304227c O(S₈)H(Db₃)Md(Pa₅)

100% Exfiltrates system info via install hooks

2026 02-19-securegate-cli-tool-v2.0.1 Apr 24 malicious-software-packages-dataset

c8a1992cc83bd01f9fcfc57f74d3d5a3f12ed7828be8cecce15ff875fbd1f7b0 K₂(AmLi)O₃(Eu₂Dy₃S₂)H₇(Cm₂₀CrDb₈F₈Os₆Po₃U)Md₃(InPa₂)

100% Postinstall drops agent skill file

2026-01-02-@rb3ca_domains v11.11.11 Apr 24 malicious-software-packages-dataset

cbe21e58d4c3a2abe2ac86b835b64ba7932126143201b5813be56c3c62df81b7 O(S₂)H(Db₂)Md(Pa₃)

96% Hollow package with preinstall hook

2026 03-01-securegate-cli-tool-v2.1.7 Apr 24 malicious-software-packages-dataset

ccf452710d10088c08dcd82269d4f054d1775362fd4b1035f531dd5c733c7dce K₂(AmLi)O₃(Eu₂Dy₃S₂)H₇(Cm₂₅CrDb₉F₈Os₆Po₃U)Md₃(InPa₂)

100% postinstall copies to OpenClaw config

2026 03-03-securegate-cli-tool-v2.2.0 Apr 24 malicious-software-packages-dataset

cfed8a5af79b9027dfbdaf2039d7fea4e34a6081688f81473e305d9bd63e72bf K₂(AmLi)O₃(Eu₂Dy₄S₂)H₇(Cm₂₅CrDb₉F₈Os₆Po₃U)Md₃(InPa₂)

100% Encrypted archive, device fingerprinting, postinstall

2025 05-12-db-cleaner-v14.5.5 Apr 24 malicious-software-packages-dataset

d5902d8370fbd5d691ca2959d2378fba3edb5ef609ab7452949f1f7052f24697 K(Am)O₃(Eu₂S₇Dy₃)H₄(Cm₁₁Db₄Os₃Po₃)Md₂(InPa₂)

100% Exfiltrates system data to Discord

2025 02-10-asdasd-ejansan-nsjansna-v1.3.0 Apr 24 malicious-software-packages-dataset

e8fcf8c3bf28e72ee02608dde4665f178eb613955c04dd32bb68f18771c6918e O(S)H₃(Cm₁₁Db₂Po)Md(In)

85% Exfiltrates system info via HTTP

2025 04-02-flutter_cupertino_date_picker-v1.0.1 Apr 24 malicious-software-packages-dataset

efd311e4e70ba0e2d39b3e419ecb63c76045cc8e203ecad1f9acf55a8a581c17 O₄(CS₃AsEr)H₄(Cm₃Db₄OsPo₄)Md(In)

100% Exfiltrates system info via raw TCP

2025 05-16-ideals-views-v1.0.0 Apr 24 malicious-software-packages-dataset

02720be991bf20e23a3d334c1deba879d36af0cf42aa744f6a347ced401cfb28 O₂(S₆Eu)H₂(CmDb₂)Md(Pa₃)

100% postinstall exfiltrates via curl

2025 03-03-configs-web-react-v10.9.9 Apr 24 malicious-software-packages-dataset

2713ace39f81fd9e851b3dca0c0005b6b51f54c8b147bd67c3b0f01becde76e3 O₂(S₈Eu)H₃(CmDb₂Po)Md(Pa₃)

100% preinstall exfiltrates system info

2026 03-02-jsx-import-test-v1.0.1 Apr 24 malicious-software-packages-dataset

2df508e936981b8e945f5e6a4068e5f63d7665e6626ce25057e7ddca6c087eab O₄(EuCDy₃S₃)H₄(Cm₈Db₃Os₂Po₂)Md₂(InPa₃)

100% Exfiltrates system data to Telegram

2026 01-13-hackerxhj-v1.2.0 Apr 24 malicious-software-packages-dataset

31269eb184a1d6b12a031e90b0a9b366801a8d66fc829cd314fe43fdf934b550 O(S₄)H₃(Cm₅Db₂Po)Md₂(Pa₂In)

100% Malicious install hooks exfiltrate data

2024 12-14-graphql.vscode-graphql-syntax-v99.99.99 Apr 24 malicious-software-packages-dataset

50f7f269ca0148e6b54d20c2030648655aaf5807848a61e647a5d5203f8f3447 O₃(S₄CEu)H₂(Db₂Po₂)Md₂(Pa₅In)

100% OOB exfiltration in preinstall hook

2024 12-18-graphql.vscode-graphql-syntax-v99.99.990 Apr 24 malicious-software-packages-dataset

529601bad3c078b3ce53fcf6510951a1435e1e694ecca07de559973596d01a00 O₃(S₄CEu)H₂(Db₂Po₂)Md₂(Pa₆In)

100% OOB exfiltration in preinstall hook

2025 03-03-configs-web-react-v14.9.9 Apr 24 malicious-software-packages-dataset

5977026e1bbe8dad7288dd458b797eb3c7d193318b89f5e54f5c0bf90fa85f53 O₂(S₈Eu)H₃(CmDb₂Po₂)Md(Pa₃)

100% preinstall exfiltrates system info

2025 07-03-grafana-scenes-ml-v1.0.0 Apr 24 malicious-software-packages-dataset

8031ea0fd391752fa00abe6fb59d14125190309582e481772e71054d9cfff3be O(S)H(Db₂)Md(Pa)

68% Encrypted archive members

2025 12-10-vue2-amis-custom-widget-pro-v1.0.2 Apr 24 malicious-software-packages-dataset

a5f9bd3ebe1a2477d847ba91350381198fbea50dd106f52bdf7942c230f356c4 O(Dy₂)H₄(Cm₃Db₅Os₃Po₂)Md₃(InPa₇)

95% DNS exfiltration of host/user identity

2025 05-30-springboot-md-v1.0.45 Apr 24 malicious-software-packages-dataset

a622d1c24147809586d4d3242ffcc4fea5aafa3401bc1e273f726ce7c6fd871f K(Mc)O₂(SAs)H₅(Cm₂Db₂Os₃Po₂U)Md(Pa₃)

100% Obfuscated exfiltration in prepare-writer

2025 06-03-springboot-md-v1.0.54 Apr 24 malicious-software-packages-dataset

b480d995098de52455ef88632ed0c27aa585517202d898dd6a19919ae175c311 K(Mc)O₂(SAs)H₅(Cm₂Db₂Os₃Po₂U)Md(Pa₃)

100% Obfuscated exfiltration in prepare-writer

2025 02-02-node-tg-bot-sdk-v0.71.8 Apr 24 malicious-software-packages-dataset

d67a782c17d4a43a2c930301d3a4bb53abfc493d7a48ea994ce044d4f02529bc KO₁₁(Dy₃PS₁₂C₄CaCo₂Eu₂AlAs₇I₃Xe)H₄(Db₄Cm₆F₂Os)Md₃(InLiPa₃)

2025 07-04-dezcord.js-v1.0.0 Apr 24 malicious-software-packages-dataset

e03d52a0178903e7282ffd0d0fcb91601d561356d9cc24851a49c4a0d78ee1fe O₄(S₅AlAsC)H₃(Db₅Os₃Po₇)Md₃(InPa)

100% Obfuscated, self-executing, anti-tamper, postinstall

2025 12-03-elf-stats-shimmering-workbench-301-v1.0.0 Apr 24 malicious-software-packages-dataset

ff7f03e0f2343a7545cc5ad1a3ff524607d7b7d7efb2997b826c59a1607a2f50 O₂(C₂S₄)H(Db₂)Md(Pa₄)

100% preinstall reverse shell to C2

2025 07-27-botframework-webchat-base-v9.9.9 Apr 24 malicious-software-packages-dataset

0d557c630c95b73c2ebfe2f1128c1031cdb3271144659623a8f91b252fa89e84 O₃(S₆CaEu)H₃(Db₂F₂Po₃)Md(Pa₇)

100% Preinstall exfiltrates hostname to OOB

2025 08-21-cwl_shared-v1.0.0 Apr 24 malicious-software-packages-dataset

21622c752e0da42b297c2b1eb79fb0cc626a93f3b29f6866da659417009b2294 O₃(Eu₂S₇Dy₂)H₄(Cm₈Db₅Os₃Po₃)Md₂(InPa)

100% Exfiltrates system info to OOB endpoint

2025 10-11-scr-cloud-project-v1.0.0 Apr 24 malicious-software-packages-dataset

2498a6c7d2b855adb6e5f731aacec778fbf87249ee378a7f3bceba0024cedb41 O₂(Ca₂S)H₂(Cm₂Db₂)Md₂(InPa)

78% Hardcoded AWS credentials in code

2025 05-08-opensource.ripple.com-v1.0.1 Apr 24 malicious-software-packages-dataset

3dcf8371df77da92949315772ac9f48980c97fa9b2d758b21abd18fc3bb61a1a O₂(S₇Eu)H₂(CmDb₂)Md(Pa₃)

100% preinstall exfiltrates system info

2025 02-18-test-hahahaha-rce1-v9.9.9 Apr 24 malicious-software-packages-dataset

3ee5316460f4a86e9e3030e063a1ee3384db7b2f11804c6d827f898edd3dffa8 O₄(S₅Eu₂CDy)H₄(Cm₂Db₃OsPo₄)Md₂(InPa₄)

100% DNS exfiltration via preinstall hook