malicious-software-packages-dataset · Index

2025-03-27-@sporta-technology_d11-web-components.popout v0.0.9999 Apr 24 malicious-software-packages-dataset

43dbd6cb5832a46200a440a4154ca77ef95748aac001b523f4de45d22cf43a20 O(S₆)H(Db₂)Md(Pa₂)

100% preinstall exfiltrates system info

2025 07-25-json-confs-v8.9.8 Apr 24 malicious-software-packages-dataset

6a3a9595a6262b30f00109ac14a03729e1c630040e4b7906d32c0b1922c4427c K(Li)O₃(Dy₃As₂S)H₅(Cm₅Db₈Os₅Po₇Ti)Md₂(LiPa₃)

96% Exfiltrates system data to remote server

2025-08-27-@liquid-web_models v1.2.9213 Apr 24 malicious-software-packages-dataset

6dbe01859489ae7ea8af02497bd1d95a2d3caffe397fe0ee3dd10fd0d222ff79 O₂(S₃Dy₃)H₅(Cm₈Db₇F₄Os₈Po₄)Md₂(InPa₂)

100% postinstall exfiltrates system data

2025 08-04-c3p-reactnative-v9.9.9 Apr 24 malicious-software-packages-dataset

7296b6b92780595838a6dd767cd6de6a06a94f51b31b5e32d9b356825b77cff5 O₂(S₆Eu)H₂(Db₂Po)Md(Pa₅)

100% preinstall exfiltrates hostname to OOB

2025 11-19-solana-dexfi-suite-v1.0.0 Apr 24 malicious-software-packages-dataset

850d6932060bc5f222da8e39060dad7a9fa612e4d8eb11f44ddfb0630a0db856 H₅(Cm₁₁CrDb₄OsPo)Md(Pa₆)

71% Malicious npm package

2025 11-10-polycard-v100.0.0 Apr 24 malicious-software-packages-dataset

866a0f9938dfe629ff0adb60c152d43d4d7163ef2b41e064d30159ab8830abb6 O₂(S₆Eu)H(Db₂)Md(Pa₆)

100% Preinstall exfiltrates system info

2025-07-03-@cpce_console-sub-app v6.9.9 Apr 24 malicious-software-packages-dataset

96e8adac305c89524b2b6e5229b84e4689cf07c14ff915fd9fe6a1bf47c7dd24 O₂(As₃S₂)H₅(Cm₃Db₈HfOsPo₂)Md(Pa)

99% Obfuscated IP exfiltration in preinstall

2025 07-08-mozilla-l10n-docs-linter-v1.0.0 Apr 24 malicious-software-packages-dataset

acce9a5219a1ca92ceadbfd72f87790698078e79b221647ae5d63229d2b10bc7 O₄(C₂Eu₂S₇Dy₃)H₄(Cm₂₀Db₆Os₆Po₂)Md₂(InPa₅)

100% Exfiltrates system info to hardcoded IPs

2025 06-03-fireblocks-netlink-v2-api-validator-v9.0.1 Apr 24 malicious-software-packages-dataset

01ef887ffc9b140a2b235fd11b8bf0fe957c74d2ac43a312e92f10db31a4d1cb O₂(S₅Eu)H₂(CmDb₂)Md(Pa₃)

100% preinstall exfiltrates via curl

2025 08-27-com.unity.sysroot-v10.0.1 Apr 24 malicious-software-packages-dataset

e462201fa97ff52b8eef46ffd2f5978388abcf44fe79136e11a1d26e67b3f2a9 O₂(S₆Eu)H₂(Db₂Po₂)Md(Pa₃)

100% preinstall exfiltrates system info

2025 11-10-polycard-v99.0.1 Apr 24 malicious-software-packages-dataset

fcf039f53e76ef7235b5c20815547f566ae124175f4eae7293bdb099f9d71872 O₂(S₇Eu)H(Db₂)Md(Pa₆)

100% preinstall exfiltrates system info

2026 01-16-chai-as-extended-v5.0.1 Apr 24 malicious-software-packages-dataset

01a97732187fa454b946e834a655af68d46575dbc00b3991ef941bfb6f61e454 K₂(McLi)O₃(C₂As₂S)H₅(Cm₉Db₇Os₂Po₈Ti)Md₄(InLiPa₃)

100% Remote code execution via axios

2025-07-28-@custom-widget_sdk v0.1.0 Apr 24 malicious-software-packages-dataset

08f51489b5ebbde85cf35a6d19c2cbbff4db0a37e11c0e16c903a9b7890f75bc O(S)H(Db₂)Md(Pa₃)

58% Dependency confusion proof of concept

2026 03-04-blackbeard-navigator-v9999.0.0 Apr 24 malicious-software-packages-dataset

1083442531e3a11c85f63d99b02d10211e69e3f97c87d85152a89b96c440c942 O₄(S₆EuErP)H₅(Cm₁₁Db₆F₇Os₅Po₆)Md₂(Pa₄In)

100% Installs web shell, exfiltrates data

2025 09-27-mad-1.0.0.2.2.8.-v1.0.9 Apr 24 malicious-software-packages-dataset

14215c4d585ef6d17d084ae07e81aec1525e800900dc81cba4e01e1709d80ece K(Am)O₃(CaAlS₂)H₄(Cm₉Db₂HfU₃)Md₂(Pa₂)

100% Phishing page with anti-analysis and redirect

2024 11-23-secret-scanning-custom-notifications-v6.0.1 Apr 24 malicious-software-packages-dataset

2b78dd8c913d8155b6527406aa6f996695ffbd36daf933a65636ad388542a457 O₂(S₇Eu)H₂(CmDb₂)Md(Pa₄)

100% Exfiltrates /etc/shadow via preinstall

2025 07-04-mre-config-react-v1.0.3 Apr 24 malicious-software-packages-dataset

32b8c799b5213dfb6a600adc008e2f01cd2efb3e5035dbaa5351724d80514af6 O₄(S₄Dy₃EuC₂)H₄(Cm₅Db₃Os₂Po₃)Md₂(InPa₃)

100% Exfiltrates system data to ngrok

2025 07-06-mre-config-react-v2.0.6 Apr 24 malicious-software-packages-dataset

3b2bd5e0f997c171390bb8b396db61f98b3aaee0ef263636d9a59363ab4d7439 O₃(S₄CEu)H₄(Cm₂Db₃OsPo)Md₂(InPa₂)

100% Exfiltrates hostname via OOB service

2025 10-29-tensor-fi-utils-lib-v1.2.2 Apr 24 malicious-software-packages-dataset

4b02d287b6e1945514e3d7f446f3d54a86fb046f4f0891593199db38fd24a997 O₂(As₂S)H₆(Cm₆CrDb₇FOs₂Po)Md₂(Pa₆)

100% Exfiltrates data to hardcoded IP

2025 02-19-zztest82-v1.0.1 Apr 24 malicious-software-packages-dataset

4e0238a58fdb7cb0ae19b7fd25aa22b2828a13c89454e132ef7e1ca67b49cfac O₂(S₇Eu)H₂(CmDb₂)Md(Pa₄)

100% preinstall exfiltrates GCP credentials

2025 12-03-elf-stats-cheery-fireplace-598-v1.0.0 Apr 24 malicious-software-packages-dataset

50797e0f86520c3fe8c3b7ec996a4528ed666dbf9e1e7cf7ab465a6a62fd2b3d O₂(S₇Eu)H₂(CmDb₂)Md(Pa₃)

100% preinstall exfiltrates /opt via curl

2025 07-05-mre-config-react-v1.0.8 Apr 24 malicious-software-packages-dataset

5602b65b8270c2278bb5ca57193aa378b05d0f28c4ff9edafec68cd870d596aa O₄(Eu₄Dy₃S₃C)H₄(Cm₅Db₆Os₃Po₂)Md₃(InPa₄)

100% Exfiltrates system info to OOB

2025 09-27-mad-1.0.0.2.2.8.-v1.0.3 Apr 24 malicious-software-packages-dataset

61776fc48fc1c66900fdb877b8cdbd0aadbe5936c6c09f58318777539e7fe58e K(Am)O₃(CaAlS₂)H₄(Cm₅Db₂HfU₃)Md₂(Pa₂)

100% Phishing page with remote payload

2024 11-16-scan-cli-v6.5.8 Apr 24 malicious-software-packages-dataset

67e96deb46dec44e0ed62c9f3b3b5b9cab57794447a8e48a78335774d02422eb K(Am)O₃(EuS₇Dy₄)H₄(Cm₁₀Db₄Os₃Po₃)Md₂(InPa₂)

100% Exfiltrates system data to Discord

2025 09-27-mad-1.0.0.2.2.8.-v1.0.5 Apr 24 malicious-software-packages-dataset

68c05ed7295e09b2ba186d654f7d4e507982b8bcb88893c5fef20669a9e9418d K(Am)O₃(CaAlS₂)H₄(Cm₉Db₂HfU₃)Md₂(Pa₂)

100% Phishing page with anti-analysis and redirect

2025-07-20-@toptal_davinci-cloudflare-requests-handler v0.2.2 Apr 24 malicious-software-packages-dataset

755ec48c8bdb9723d60a0afd1e5e7cf896e7251c8f81c25ce396859a0d53d0c8 O₃(IS₅Eu)H₄(CmDb₃FPo)Md(Pa₄)

100% preinstall exfiltrates token, deletes root

2025 09-22-redirect-1st7z7-v1.0.0 Apr 24 malicious-software-packages-dataset

827095a94fff74186863b991cf17c8b2404c9e2b80a2f3cc2dd1633289969620 K(Te)H₆(Cm₃Db₅F₂OsPoU₂)Md(Pa)

64% Automated malicious npm package generator

2025 12-03-tailwind-variables-v2.3.1 Apr 24 malicious-software-packages-dataset

8957b3cafe691d8589331e9a96d3df28df30eed33121b8562495399a2e6b3443 H(Db₃)

Legitimate CSS utility package

2025 10-28-tensor-fi-utils-lib-v1.1.2 Apr 24 malicious-software-packages-dataset

a3bf8064f628555facc50b5b2933b424981495e2ff6fbb9b9ac985f9f5ba882e O₂(As₂S)H₅(CrDb₅FOsPo)Md₂(Pa₆)

100% Obfuscated key file exfiltration

2025 01-10-automerge-action-v9.9.9 Apr 24 malicious-software-packages-dataset

a414d02f51414955e3f89e93cf5a676b7f34b1978bc2bb550b7f1151adfb1d67 O₂(S₆Eu)H₂(CmDb₂)Md(Pa₄)

100% preinstall exfiltrates /etc/passwd

2025 09-27-mad-1.0.0.2.2.8.-v1.0.8 Apr 24 malicious-software-packages-dataset

adf7698bb2029de57b7182cce3f7a9f74d21417152707f2df44778ad81464031 K(Am)O₃(CaAlS₂)H₄(Cm₉Db₂HfU₃)Md₂(Pa₂)

100% Phishing page with anti-analysis and redirect

2025 09-27-mad-1.0.0.2.2.8.-v1.0.4 Apr 24 malicious-software-packages-dataset

b65d9a1c1cbc002a0fb9a29e091f3af3786bb011c32326b8f9f56b295a59eea2 K(Am)O₃(CaAlS₂)H₄(Cm₉Db₂HfU₃)Md₂(Pa₂)

100% Phishing page with anti-analysis and redirect

2025 10-28-tensor-fi-utils-lib-v1.0.0 Apr 24 malicious-software-packages-dataset

d844ec49a3f68487b20f5e9b2dd667b1f30c97152d743d6b2fa80ab1d8780a99 H₆(Cm₅CrDb₅F₄OsPo)Md(Pa₆)

70% Encrypted ZIP entries

2025 09-27-mad-1.0.0.2.2.8.-v1.0.1 Apr 24 malicious-software-packages-dataset

c5c84c6325aabfcf378a2e3ccf3ebb7940296efda7fc1d21a6ed511704c68027 K(Am)O₄(CaAlCS₂)H₄(CmDb₂HfU₃)Md₂(Pa₂)

100% Phishing page impersonating Uniswap

2025 07-05-mre-config-react-v1.0.5 Apr 24 malicious-software-packages-dataset

ce3963dc82ce38ce3e5c00c77596a3fe69b9ab9ababc7ba4d1a6978cad5b6393 O₄(Eu₂S₄CDy)H₄(Cm₂Db₅Os₃Po₂)Md₂(InPa₂)

100% Exfiltrates system info to OOB domain

2025 07-05-mre-config-react-v1.0.6 Apr 24 malicious-software-packages-dataset

d3971371a64920ab296a75475a2dacc69cec3cec5a7aaa98da2e8f5723974f5f O₂(CEu)H₃(Cm₃Db₄Os)Md₂(InPa₃)

90% Exfiltrates data to OOB domain

2025 02-22-zztest82-v1.0.2 Apr 24 malicious-software-packages-dataset

f114b8383b51c9c79e9d56d129f7ff170deb744a5e49ae95d5036922f14992ae O₂(S₇Eu)H₂(CmDb₂)Md(Pa₄)

100% preinstall exfiltrates GCP token

2025 08-23-code-processor-v99.0.9 Apr 24 malicious-software-packages-dataset

fe9422d7be0bf58266d9970125dd5d87588250ecf09f53fcf8b4a45017b655ff O₂(S₈Eu)H₃(CmDb₂Po)Md(Pa₅)

100% Exfiltrates /etc/passwd via preinstall

2025 05-22-service-config-provider-v1.3.0 Apr 24 malicious-software-packages-dataset

85c82466136cb7a026bf2aeac7c9f47ef35cdc1eb282eb007f72113f2bdfd827 O₄(S₆CDy₃Eu)H₄(Cm₁₂Db₅Os₆Po₂)Md₂(InPa₅)

100% Exfiltrates system info to hardcoded IP

2026 04-11-unisys-core-v99.99.1 Apr 24 malicious-software-packages-dataset

6affd54bcd0e5186dc371f1b11dfaf8e62a98a035cb10ba2d468f136fdb1c197 O₂(S₅Dy₂)H₄(Cm₆Db₄Os₃Po₂)Md₂(Pa₄In)

100% Exfiltrates system info to C2

2025-12-31-@rashidazarang_airtable-mcp v3.2.8 Apr 24 malicious-software-packages-dataset

0d05ec88420fb5798493a26b23c2d2de5f5682775ad48082655c07868604aa99 K(Li)O(S)H₆(Cm₁₄Db₈F₄Os₄Po₅U)Md₂(InPa₈)

40% Legitimate Airtable MCP server

2025-10-28-@rashidazarang_airtable-mcp v3.2.5 Apr 24 malicious-software-packages-dataset

226dec9e2f77f24a2a8c97e062e6b14b68538598e937f6c2b75ebd40081d49af K(Li)O(S)H₆(Cm₁₄Db₆F₄Os₄Po₅U)Md₂(InPa₈)

70% Malicious npm package dataset

2025-08-16-@rashidazarang_airtable-mcp v3.1.0 Apr 24 malicious-software-packages-dataset

23414003ceefb0cd443029d0c37a6ecc6b92dc336267ff759d7ca1e3bead1953 K(Te)H₇(Cm₁₈Db₁₁F₅Os₂Po₈TiU₃)Md₂(InPa₈)

64% Malicious npm package dataset

2025-08-16-@rashidazarang_airtable-mcp v2.2.2 Apr 24 malicious-software-packages-dataset

33c828698a205ac34cedb8f8b42a00f3cb020f05d6b884cafc63e644aad69dbf K(Te)H₇(Cm₁₆Db₁₀F₅Os₂Po₈TiU₃)Md₂(InPa₄)

59% Malicious npm package dataset

2025-08-16-@rashidazarang_airtable-mcp v3.0.0 Apr 24 malicious-software-packages-dataset

35d4362e3e293063dc6ab33615fe6e26992f319fe3a5df5014a3bf5c0b3926e3 K(Te)H₇(Cm₁₆Db₁₀F₅Os₂Po₈TiU₃)Md₂(InPa₄)

58% Malicious npm package with obfuscated code

2025 08-26-epc-help-widget-v1.0.0 Apr 24 malicious-software-packages-dataset

7ed78fa6e8827bf39c1209486869b410afd3d77ac28fe2e5bf8dd7a7a562ab37 KO₃(S₈ErXe)Md(Pa)

2025-08-25-@espace-client-axafr_savings-card v1.0.0 Apr 24 malicious-software-packages-dataset

94d6c23334cb69f47d69ab918eefc912ea9912ea4a25ffb0ea6c4af18d0b2dd5 O(S₈)H₃(CmDb₂Po)Md(Pa₃)

100% preinstall exfiltrates system info

2025-08-16-@rashidazarang_airtable-mcp v2.1.1 Apr 24 malicious-software-packages-dataset

9bd430496252e1ed67acc653a1368ab62727944bc0aba04842fd1e88c2814a81 K(Te)H₇(Cm₁₅Db₆F₅OsPo₈TiU)Md₂(InPa₄)

57% Malicious npm package dataset

2025-08-15-@rashidazarang_airtable-mcp v1.6.0 Apr 24 malicious-software-packages-dataset

b132592cfb847352bc55e0e020084b0b16cc87bc1d898efccd4adbe4b9ccfaf6 K(Te)O(C)H₆(Cm₂₉Db₁₀F₇Os₆Po₁₂U)Md₃(BkInPa₃)

58% Nested archives, encrypted entries, dropper

2025 10-10-tailwind-setting-v3.7.2 Apr 24 malicious-software-packages-dataset

cecc3d39b7a14c06c349e58377c0f24ae46a4cda84d45c6e561dd4bc183d0af4 O₂(SAs)H₅(Cm₃Db₅Os₂Po₂U)Md(Pa₅)

96% Exfiltrates env vars via eval

2025-08-16-@rashidazarang_airtable-mcp v2.2.0 Apr 24 malicious-software-packages-dataset

d71cb5f46664646437f8aa2734377c3011b716e45084ad44473ca5e2ce5db4fd K(Te)H₇(Cm₁₆Db₇F₅Os₂Po₈TiU₃)Md₂(InPa₄)

58% Malicious npm package dataset

2025-08-16-@rashidazarang_airtable-mcp v2.1.0 Apr 24 malicious-software-packages-dataset

df1bb42c058ee2a35c0c86d5702cc81d6b6be6ece88c67fceabc0f70ba4964ac K(Te)O(C)H₉(Cm₃₆CrDb₁₃F₁₃Os₁₂Po₁₃Ti₂U₆)Md₄(Bk₄InPa₃)

67% Malicious npm package with obfuscated code

2025 02-27-reason-calculator-v3.1.1 Apr 24 malicious-software-packages-dataset

f1b00fe587b31dc747accd2fd9b046e7ad09563049d6e5897b9dfc4a8fa97311 O₄(Eu₃S₉Dy₅C)H₄(Cm₅Db₄Os₂Po₄)Md₂(InPa₂)

100% Exfiltrates system info to OOB domain

2025 11-22-auth-handler-v2.5.8 Apr 24 malicious-software-packages-dataset

25b832d7a624318fd05a5cbd9e46f5eb8c47b3e4203c8fd31971477a2920b5f1 K₂(McLi)O₃(C₂S₂As₂)H₅(Cm₉Db₈Os₂Po₈Ti)Md₄(InLiPa₃)

100% Remote code execution via eval

2026 02-24-cortana-md-bot-v1.0.0 Apr 24 malicious-software-packages-dataset

268494ca2c679af1c043e938431e568c48dbe90dd5f8ed5d66478dff10dca617 O₂(S₂As)H₅(Cm₅Db₉F₂OsPo₂)Md(In)

100% Obfuscated code, encrypted archive, auto-update

2025 09-19-internal-runtime-v10.0.1 Apr 24 malicious-software-packages-dataset

31c419928081249946253775725a1cff64486c66a875d9c9e0ff44b63c894058 O₂(S₆Eu)H₂(Db₂Po)Md(Pa₃)

100% preinstall exfiltrates system info

2025-05-01-@ebay-business-components_marko-rum v99.9.1 Apr 24 malicious-software-packages-dataset

3645dd812b7693642ae94defd6e5fc51d755f8b253035fdb604574e249361635 O₃(S₃Eu₂Dy)H₄(Cm₆Db₅Os₂Po₂)Md₂(Pa₅In)

100% Exfiltrates system info via OOB

2025 07-27-sirius-import-article-v5.0.0 Apr 24 malicious-software-packages-dataset

59d1ab122dc37d3264626a4a86e4ff61b6b7154ff03c7a04fd258d04c9f3e526 O₂(S₈Eu)H₃(CmDb₂Po)Md(Pa₃)

100% preinstall exfiltrates system info

2024 12-25-swap-subgraph-v2.0.0 Apr 24 malicious-software-packages-dataset

70f2ef444aef46c3aba3a2a669b34b148acd24849d28cc00cbdecb3ee49d1913 O₃(C₂S₄Er)H₃(Cm₂Db₂Po₆)Md₂(InPa₂)

100% Reverse shell with C2 IP

2025-07-28-@ai0x1337_budoux-extension v99.0.0 Apr 24 malicious-software-packages-dataset

8b8ebd8f083e18725f77a35485bca3c1638de336ae3599738e19fa0bee581227 O₂(S₈Eu)H₇(Cm₂Db₄FOs₂Po₂U₃)Md₄(Pa₈Bk)

100% postinstall exfiltrates identity to OAST

2025 02-03-node-tg-bot-sdk-v0.71.9 Apr 24 malicious-software-packages-dataset

75bafc8ab44ee4a325ba74b46dfbf935fcaa217fb399936bc8013546dfc9a834 K₂(Mc₂Li₂)O₇(PS₄As₂CaCCoDy)H₇(CrBrCm₂₄Db₁₃F₁₂Os₄Po₅)Md₃(InPa₈Pt)

100% SSH key persistence, C2 beaconing

2025-07-29-@xcxcxxx_gsap3 v99.10.90 Apr 24 malicious-software-packages-dataset

932d1e6de87790636be99bb24ab6097501c6d0e92c127b6355194164d77812e6 O₃(Eu₃S₉Dy)H₄(Cm₇Db₅Os₂Po₂)Md₂(Pa₅In)

100% Exfiltrates system info via preinstall

2024 11-12-eslint-plugin-foody-custom-v7.1.9 Apr 24 malicious-software-packages-dataset

9c0140336623764507c2a7715e2a3371b17a9a9e3c72ffa9e1dfce3a7e5dd64d K₂O₉(S₁₀C₆CaDy₃EuCoXeAs₂I)H₃(Cm₅Db₂Os)Md₂(InPa₃)

2025 07-08-playwright-e2e-testing-v10.0.0 Apr 24 malicious-software-packages-dataset

e6f5c1b3802585caefbd3b62e04fb53c9cd80dbf28bf30eed12fda9b454cc1ae O(S₇)H₂(Db₂Po)Md(Pa₃)

100% Preinstall exfiltrates system info

2025 10-23-bad-santa-claude-v1.2.0 Apr 24 malicious-software-packages-dataset

384f3b1bbc59145f831b373833afe6735d8a850fc411727d60fb3b5f0cb27ff1 K(Am)O₂(EuS₂)H₃(Cm₆Db₃Po)Md₂(InPa₂)

100% preinstall hook exfiltrates to Discord

2024 11-09-pentest-helper-v3.0.0 Apr 24 malicious-software-packages-dataset

39c4be890bae755044424bdefdc5cd7a27d5085629eed6f6a9a7bcc98f9f6685 O₂(S₇Eu)H₂(CmDb₂)Md(Pa₃)

100% Exfiltrates /etc/passwd via preinstall

2025 01-25-showcase-server-v102.9.9 Apr 24 malicious-software-packages-dataset

4b40b59ff37ca47b069d28e075419d6c6ef21b80721c4ef3a73970917464f574 O(S)H₃(CmDb₂Po₆)Md₂(InPa₃)

85% Remote shell backdoor

2025 01-25-showcase-server-v101.9.9 Apr 24 malicious-software-packages-dataset

6cec03150a8406fbe3de21c2630fd7ed79140e297208fbd8b8bfb0e9870ebb42 O(S)H₃(CmDb₂Po₆)Md₂(InPa₃)

85% Remote shell backdoor

2026 01-22-pap-client-v32.0.1 Apr 24 malicious-software-packages-dataset

75fb78cde7927dd86e2f054f52f2365cb5a2e1e9ed1d4dac0ff5e515de635df4 O₂(S₂Dy)H₄(Cm₃Db₃OsPo₂)Md(Pa₄)

94% postinstall exfiltrates system info

2025 10-26-bad-santa-claude-v1.5.0 Apr 24 malicious-software-packages-dataset

cbfdfb668ae8231acb0ec9df6cbf30e9635bf410b08be04f273b0c529f98fba2 K(Am)O₂(EuS₂)H₃(Cm₆Db₃Po)Md₂(InPa₂)

100% preinstall hook exfiltrates to Discord

2025 01-25-showcase-server-v99.9.9 Apr 24 malicious-software-packages-dataset

b4757379fe94bdbef8e0bf0752113b227ca0554cdaf941a283e2aa3b7275ec03 O(S₂)H₃(CmDb₂Po₆)Md₂(Pa₃In)

100% Remote shell backdoor

2025 08-05-shmam-test-blueberry-v3.0.0 Apr 24 malicious-software-packages-dataset

dee070b6dcf08ecc9cd6a8e47fbf91bfdd2fa38e27e06dc06e665a1c592a39d5 O(S)H(Db₂)Md(Pa₂)

69% Encrypted archive members

2026 01-23-pap-client-v42.0.1 Apr 24 malicious-software-packages-dataset

ee9809bc1538a6e3647757c289f3a356f272174283504997dfae9e67a39ff63b O(S₂)H₃(Cm₃Db₃Po)Md(Pa₅)

92% postinstall exfiltrates system data

2024 12-30-typespublishercontenthash-v99.99.99 Apr 24 malicious-software-packages-dataset

f014095c897ac741aa5e9aa843e53f671c1e384fa140d48f1ea426f33feb7ce0 O₃(S₅CEu)H₂(Db₂Po₂)Md₂(Pa₄In)

100% OOB exfiltration in preinstall hook

2026 04-12-upstartportal-v99.99.1 Apr 24 malicious-software-packages-dataset

d03f64e6b9f3ac361552c8df4be72344ee0508e19c9ad81067ccf741cbefa74c O₅(Ca₄Eu₄S₇Dy₄P)H₅(Cm₉Db₈F₁₂Os₁₄Po₇)Md₃(Pa₄In)

100% Credential stealer with C2 exfiltration

2025 03-14-vertex-core-v99.0.0 Apr 24 malicious-software-packages-dataset

1ab3e380fe5653d312afb75b1223d5dc6a478d5bf53db7a08465246b39e3dc70 O₂(S₆Eu)H₂(CmDb₂)Md(Pa₄)

100% Exfiltrates environment via postinstall

2025 07-08-vite-lightparse-v1.0.0 Apr 24 malicious-software-packages-dataset

479f99cb7ae31f384723d20373d6bc6fe14e72c0a953a85618163f29cbaf9a47 O₂(SAs)H₅(Cm₃Db₅Os₂Po₂U)Md(Pa₅)

97% Exfiltrates env vars to remote server

2026 01-08-huggingface-js-v1.0.1 Apr 24 malicious-software-packages-dataset

417cf51528b539325d668ecfbd557b85d4b7cd2ea1e26fd9052937c623286162 K(Mc)O₅(As₁₀S₆CPXe)H₇(CmCrDb₁₁F₂Mg₂Os₆Po₈)Md₅(Bi₄InPa₅PtSi)

100% Obfuscated postinstall, process injection APIs

2025 08-26-labelbox-custom-ui-v99.0.0 Apr 24 malicious-software-packages-dataset

76351a9f55cf60c87a0a80b6bdec2ef1882a03c7dcadb092073614c55a14eae4 O(S₃)H(Db₂)Md(Pa₆)

100% Typosquatting, HTTP deps, obfuscated name

2025-07-03-@cewe-designsystem_component_modal v99.9.0 Apr 24 malicious-software-packages-dataset

ab007d1200a5c52b40e32d160a8824b0729c12168870020a9d66c4a00698deb7 O₂(S₃Dy)H₄(Cm₄Db₅Os₂Po₂)Md₂(Pa₆In)

100% preinstall exfiltrates system identifiers

2025 12-20-escaux-scrumboard-api-v999.0.0 Apr 24 malicious-software-packages-dataset

0711a624846437a6582982993be2c8695c2101c477fafa79123a6caa33901e9c O₃(S₉AsEu)H₂(Db₃Po)Md(Pa₈)

100% preinstall exfiltrates hostname to OAST

2026-01-06-@bingads-webui-cc-react_edit-primary-contact v99.9.9 Apr 24 malicious-software-packages-dataset

05a49029124a2d2ddb9aac268c4f7e5f67c9daf10f5f97e288092c32bb871167 O₄(S₇CDyEu)H₄(Cm₃Db₂OsPo₂)Md₂(Pa₆In)

100% DNS exfiltration of victim identity

2025-12-20-@ikarem_telemetry v100.1.6 Apr 24 malicious-software-packages-dataset

7e2063e011b2405f20de84337a84e56550304cbe430f8c593db4a0942218f4b3 O(S₃)H₃(Cm₂Db₄Os₃)Md(Pa₇)

100% Exfiltrates system info via install hooks

2025-09-09-@oneaudi_unified-web-common v18.1.3 Apr 24 malicious-software-packages-dataset

a98c59d4ad59f13f2bc963b716ec5438dbd13ce044cf51b2e1e53a937cab405c O₄(Eu₃S₅Dy₃C)H₅(Cm₈Db₄F₃Os₄Po₂)Md₃(InPa)

100% Exfiltrates system data to webhook.site

2025-06-01-@seo-frontend-components_card-blog-carousel-mobile v1.999.1 Apr 24 malicious-software-packages-dataset

fe2fdcb1aa812988991c60191058fc0e8334d12a59388f795feabfffbb170e31 O(S₃)H₃(CmDb₃Po₂)Md₂(InPa₅)

98% preinstall exfiltrates system info

2025 07-08-enterprise-stencil-v200.0.0 Apr 24 malicious-software-packages-dataset

a3b3586cb045c63fafab632d7155e495091ce3298dfb41ec325a88175d720390 O₇(As₅S₁₂CaEuDyXeC₃)H₃(Cm₂DbOs)Md₃(Pa₃InLi)

2025-09-19-@hash-validator_v2 v1.22.5 Apr 24 malicious-software-packages-dataset

513dc19b753a11646cf9e08ac9f8a9ee174bbaeeef81a03903c5f42f1216c2df O(As)H₄(Cm₅Cr₃Db₆Po)Md₂(Pa₉)

91% Obfuscated remote code execution

2025-11-16-@wxi-dev_serverless-tsc-config v1.0.2 Apr 24 malicious-software-packages-dataset

38f2cdf133d35b02d4ad1fa26ee359477dea5b97c1a7194fe9b271196fdc767f O₄(S₅AsCDy)H₈(Cm₈CrDb₁₁F₆Os₅Po₇TiU)Md₂(Pa₄)

99% Exfiltrates environment variables to ngrok

2026 01-17-admin10001-v1.0.139 Apr 24 malicious-software-packages-dataset

f180f78801925fbee77ce41f48a4bd60d4bdd1e93b08ad1ad6401a2e6d4451bc O₂(S₆Eu)H₂(CmDb₂)Md(Pa₃)

100% preinstall exfiltrates to OOB

2025 09-08-com.revenuecat.purchases-unity-v13.7.0 Apr 24 malicious-software-packages-dataset

ae6676c81dc3883beec2a653268ea539ddebe9a9ddf3f26f4053df85e2944156 O₂(Eu₃S₄)H₄(Cm₂Db₂FPo₃)Md₂(InPa₂)

100% Exfiltrates system credentials via curl

2025-07-03-@cpce_console-sub-app v0.9.9 Apr 24 malicious-software-packages-dataset

3ce4248ef9c0509c12d92e56469dc87fe1f1834b61c9753d5c796098573b7aac O₂(As₃S)H₅(Cm₃Db₈HfOsPo₂)Md(Pa)

98% Obfuscated IP exfiltration in preinstall

2026 01-17-admin10001-v1.0.124 Apr 24 malicious-software-packages-dataset

81823d81300ddd582cdba1fd10d4a54ed7c869ac43128b1dfbd3f8ffa7224deb O₂(S₇Eu)H₂(CmDb₂)Md(Pa₃)

100% preinstall exfiltrates credentials via curl

2025-02-23-@od-react_od-react-test v1.0.0 Apr 24 malicious-software-packages-dataset

c5e099eb85953711e1a8231bbf443000019005eb9a3359af3666f5d6f3691a25 O(S₂)H(Db₂)Md(Pa₄)

96% Hollow package with install hook

2026 01-17-admin10001-v1.0.59 Apr 24 malicious-software-packages-dataset

f381658445b4b749cdab2dd3bf403209ad0f155891af09bfae7f54cc468181fe O₂(S₉Eu)H₃(CmDb₂Po₂)Md(Pa₃)

100% preinstall exfiltrates credentials to OOB

2026 01-17-admin10001-v1.0.116 Apr 24 malicious-software-packages-dataset

47cb01c2fdf36e335b4ce72dd9a1173338d3a2086ecadce40453b585f192b30a O₂(S₇Eu)H₂(CmDb₂)Md(Pa₃)

100% preinstall exfiltrates secrets via curl

2026 01-17-admin10001-v1.0.54 Apr 24 malicious-software-packages-dataset

bec37c30072bc67805db06f9efd92bab7a00cebfcc7d84c191dc1915e41a66c8 O₂(S₆Eu)H₂(CmDb₂)Md(Pa₃)

100% Exfiltrates SSH key via preinstall

2026 02-04-chai-promised-await-v3.3.5 Apr 24 malicious-software-packages-dataset

2350da883305211100ec13d98e60acc569dd699283cbd049db111cd0118fd2a9 K₂(McLi)O₃(C₃As₂S)H₅(Cm₉Db₈Os₂Po₈Ti)Md₄(InLiPa₃)

100% Remote code execution via base64

2026 01-17-admin10001-v1.0.181 Apr 24 malicious-software-packages-dataset

34bcbac5c79d4fc728d0812ec114af2be58df98859b26320a3c03587271d77fa O₂(S₇Eu)H₂(CmDb₂)Md(Pa₃)

100% preinstall exfiltrates process list

2024 12-07-calendervue-v1.0.0 Apr 24 malicious-software-packages-dataset

ab0e1e74101ed4b39d9e22f2c6344ae2926e06386dc8452270555d3041cba43e O₂(S₇Eu)H₂(CmDb₂)Md(Pa₄)

100% preinstall exfiltrates /etc/passwd

2026 01-18-admin10001-v1.0.331 Apr 24 malicious-software-packages-dataset

ac96c9b74b28941b8484e7926d8e9b347cf28c2797eb6c7fb4beab87f901fb2f O₂(S₅Eu)H₂(Db₃Po)Md(Pa₃)

100% preinstall exfiltrates SSH key