Use pre-defined keywords for filtering and detections

All OpenSourceMalware threat records are tagged with various categories keywords that help you to better understand the threats and look for trends. For example, you can use tags to:

Quickly filter the web UI search by keyword - search for #tag-name on opensourcemalware.com
Pivot on a tag within a threat record (on the website) to see all records associated with that concept
If you’re consuming the APIs, use tags from the responses to internally filter reports and set up your own workflows (e.g. alerts)

When searching by tag on the homepage, use all lowercase and replace spaces with hyphens. For example: account-takeover or teampcp, not Account Takeover or TeamPCP.

This page is not an exhaustive list of tags used in the platform. As new malware and campaigns are discovered, naturally new tags are needed.

Tag categories

Our tags generally fit into these 11 categories:

Category	Description
Ecosystem	The registry or platform the record belongs to
Threat actor group	The known group responsible
Campaign	The named campaign this record belongs to
Malware family	The named malware family this payload belongs to
Malware type	What the malware does
Attacker tactic	How the attacker delivered or disguised the malware
Execution method	How the malware runs
Infrastructure	Services or platforms abused as part of the attack operation
Targeting	What the malware is specifically going after
Victim	A specific organization, platform, or technology targeted by the attack
Language	The human language present in the malware or package content

Ecosystem

Although the threat records are categorized by ecosystem, we also add an ecosystem tag to offer faster searches.

Tag	Definition
`npm`	npm package registry
`pypi`	Python Package Index
`rubygems`	RubyGems registry
`nuget`	NuGet registry
`openvsx`	Open VSX registry
`vscode`	VS Code Marketplace
`crates`	crates.io (Rust)
`maven`	Maven Central (Java)
`packagist`	Packagist (PHP/Composer)
`homebrew`	Homebrew (macOS)
`github`	GitHub repository
`gitlab`	GitLab repository
`docker`	Docker Hub
`go`	Go module proxy
`cargo`	Cargo (Rust) - use `crates` for the registry itself
`skill`	AI skills

Attribution

Attribution tags require high-confidence evidence. We break attribution into three categories:

Threat actor group
Campaign
Malware family

A record can carry attribution tag types independently. For example, a confirmed malware family doesn’t require a known campaign, and a known campaign doesn’t require an identified threat actor group.

Threat actor group

Threat actor group is the most challenging attribution category because most threat actors don’t want to be recognized. Two that you will see frequently used in our records are:

Tag	Definition
`dprk`	North Korean state-sponsored threat actors
`teampcp`	TeamPCP, a cloud-native financially motivated threat actor

Campaign

Campaign tags identify a named, tracked series of related attacks. These are some examples:

glassworm is an unattributed campaign first discovered in October 2025. It targets software developers by compromising popular extensions (such as for VS Code or OpenVSX) and packages across ecosystems like npm, PyPI, and GitHub.
contagious-interview (fake interviews aimed at infecting developers with malware for the purpose of stealing crypto and credentials) and polinrider (a persistence and infection mechanism often packaged up in the Contagious Interview malware) are two related campaigns attributed to North Korean state actors.
shai-hulud was an unattributed npm worm campaign during 2025. mini-shai-hulud was an unrelated npm worm disseminated by TeamPCP in 2026.
indonesianfoods was a npm spam campaign that doubled the volume of malicious npm findings in 2025.
agentbaiting is an ongoing campaign where the threat actor spreads lure repos on GitHub to trick agents into installing malware.

Where a campaign has sub-variants or waves, we may use an umbrella tag (such as shai-hulud) and a specific variant tag (e.g. shai-hulud-second-coming).

Malware family

Malware families are strains of malware that are reused by threat actors across multiple attacks or through an extended campaign. These are just some of the ones we have tagged:

Tag	Definition
`beavertail`	DPRK infostealer delivered via Contagious Interview
`ottercookie`	DPRK second-stage payload associated with Contagious Interview
`invisibleferret`	DPRK Python backdoor associated with Contagious Interview
`weaslebiscuit`	An unattributed infostealer
`miasma`	A highly-aggressive variant of the Mini Shai-Hulud worm open-sourced by the threat group TeamPCP
`amos-stealer`	macOS infostealer targeting browser credentials and crypto wallets
`xcsset`	macOS malware that injects into Xcode projects
`xmrig`	Open-source Monero miner commonly embedded in malicious packages

Malware type

This category describes what the malware does and may include several complementary tags. For example, a malicious package can be both a dropper and an infostealer.

Tag	Definition
`infostealer`	Collects and exfiltrates sensitive data including credentials, tokens, and environment variables
`backdoor`	Establishes persistent unauthorized remote access to the victim system
`trojan`	Malicious package disguised as or bundled with legitimate functionality
`trojanized`	A previously legitimate package that has been modified to include malicious code
`worm`	Self-propagating malware that spreads to other packages or systems without user interaction
`dropper`	Delivers and executes a secondary malicious payload
`downloader`	Fetches a remote payload but does not execute it directly
`loader`	Loads and executes a payload already present on the system
`rat`	Remote Access Trojan, provides interactive remote control of the victim system
`cryptominer`	Uses victim system resources to mine cryptocurrency
`cryptostealer`	Steals victim’s cryptocurrency wallets, keys, or credentials
`keylogger`	Records keystrokes to capture credentials or other sensitive input
`ransomware`	Encrypts victim data and demands payment for decryption
`spyware`	Passively monitors and exfiltrates victim activity
`credential-theft`	Targets authentication credentials specifically
`wallet-stealer`	Targets cryptocurrency wallet files or seed phrases

trojan and trojanized are distinct. trojan describes a package built from scratch to appear legitimate. trojanized describes a package that was once legitimate and has been modified by an attacker.

Attacker tactic

How the attacker delivered or disguised the malware.

Tag	Definition
`account-takeover`	A legitimate, previously trusted asset was compromised through unauthorized access to a maintainer or publisher account, regardless of how that access was obtained
`name-confusion`	A deceptive asset name tricks users or automated systems into installing a malicious package
`dependency-confusion`	Exploits how package managers resolve dependencies between public and private registries, causing the malicious public package to be installed instead of the intended internal one
`dependency-injection`	A malicious dependency is introduced into an otherwise legitimate project
`ci-poisoning`	Malicious code is injected into a CI/CD pipeline or build configuration
`social-engineering`	The attacker used deception or manipulation of a person to deliver the malware or gain access (includes fake recruiter, deceptive development, and similar lures)

account-takeover signals that a previously trusted package has been weaponized. When you see this tag, the package was once safe. Prioritize review of any use of this package prior to the compromise date.

Name confusion sub-types

When applying name-confusion, also apply the appropriate sub-type tag.

Tag	Definition
`typosquat`	Exploits typographical errors or close misspellings of a legitimate asset name
`brandjacking`	Uses a name that appears connected to a legitimate brand, project, or ecosystem (doesn’t rely on misspellings)
`slopsquatting`	Registers a name that AI coding assistants hallucinate

Execution method

How the malware runs. These tags describe the mechanism of execution, not the payload behavior.

Tag	Definition
`install-script`	Malicious code executes via a package install hook (preinstall, postinstall, or equivalent)
`postinstall`	Specifically executes via the postinstall hook
`preinstall`	Specifically executes via the preinstall hook
`import-time-execution`	Malicious code runs when the package is imported or required, without explicit invocation
`ide-autorun`	Executes automatically when an IDE opens a workspace, project, or folder
`entry-main`	Malicious code is in the package’s primary entry point
`obfuscation`	Code has been deliberately obscured to hinder analysis
`evasion`	The malware takes active steps to avoid detection or analysis environments
`persistence`	The malware establishes a mechanism to survive reboots or re-installation
`multi-stage`	The malware uses more than one stage of execution, with an initial payload delivering a secondary one
`dead-drop`	The malware retrieves its configuration or secondary payload from a publicly accessible service rather than a dedicated C2 server
`dll-hijacking`	Exploits Windows DLL search order to load a malicious library in place of a legitimate one
`lolbin`	Uses legitimate, trusted system binaries to execute malicious actions

Infrastructure

Services, platforms, or protocols abused as part of the attack operation. May be used for exfiltration, C2, or payload hosting.

Tag	Definition
`telegram`	Uses Telegram bots or channels for C2 or exfiltration
`discord`	Uses Discord webhooks or channels for C2 or exfiltration
`slack`	Uses Slack for C2 or exfiltration
`vercel`	Abuses Vercel for payload hosting or C2
`jsonkeeper`	Uses jsonkeeper.com as a dead-drop C2
`npoint`	Uses npoint.io as a dead-drop C2
`oast`	Uses out-of-band application security testing infrastructure for data exfiltration
`solana-c2`	Uses the Solana blockchain as a covert C2 channel
`ethereum`	Uses the Ethereum blockchain for C2 or payload delivery
`tron`	Uses the TRON blockchain for C2 or payload delivery
`exfil-custom-c2`	Exfiltrates to attacker-controlled infrastructure not covered by another tag
`pastebin`	Uses paste sites for payload hosting or data exfiltration
`ngrok`	Uses ngrok tunneling for C2
`cloudflare-worker`	Abuses Cloudflare Workers for payload delivery or C2

Targeting

What the malware is specifically going after. This is just an example list - there are many other targets.

Tag	Definition
`cryptocurrency`	Targets cryptocurrency assets, wallets, or infrastructure
`env-exfil`	Targets environment variables, which commonly contain secrets, tokens, and credentials
`aws`	Specifically targets AWS credentials or infrastructure
`ai`	Targets AI tooling, models, agents, or AI developer workflows
`solana`	Specifically targets the Solana ecosystem
`polymarket`	Specifically targets Polymarket users or infrastructure
`defi`	Targets decentralized finance protocols or infrastructure
`geo-targeting`	The malware activates or behaves differently based on the victim’s geographic location
`developer-targeting`	Specifically crafted to target software developers rather than end users

Victim

A specific organization, platform, or technology targeted by the attack. The actual brand may be the target, or users of the brand’s services. We typically use this when the record is part of a campaign directed at a named target. For example: aws, mastra, anthropic, openai, okta, coinbase, redhat.

Some tags like aws can appear in both Targeting and Victim depending on context.

Language

The human language present in the malware or package content. Useful for attribution and clustering. For example:

Tag	Definition
`lang-chinese`	Chinese language text present
`lang-cyrillic`	Cyrillic script present (Russian, Ukrainian, Bulgarian, etc.)
`lang-arabic-farsi-urdu`	Arabic script present (Arabic, Farsi, Urdu)
`lang-korean`	Korean language text present
`lang-japanese`	Japanese language text present
`lang-arabic`	Arabic specifically (use when language is confirmed as Arabic rather than Farsi or Urdu)
`lang-greek`	Greek language text present
`lang-thai`	Thai language text present
`lang-hebrew`	Hebrew language text present
`lang-vietnamese`	Vietnamese language text present

Get Started

Reporting Threats

Community

Use pre-defined keywords for filtering and detections

Tag categories

Ecosystem

Attribution

Threat actor group

Campaign

Malware family

Malware type

Attacker tactic

Name confusion sub-types

Execution method

Infrastructure

Targeting

Victim

Language

​Tag categories

​Ecosystem

​Attribution

​Threat actor group

​Campaign

​Malware family

​Malware type

​Attacker tactic

​Name confusion sub-types

​Execution method

​Infrastructure

​Targeting

​Victim

​Language

Tag categories

Ecosystem

Attribution

Threat actor group

Campaign

Malware family

Malware type

Attacker tactic

Name confusion sub-types

Execution method

Infrastructure

Targeting

Victim

Language