> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opensourcemalware.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Use pre-defined keywords for filtering and detections
> Tags are labels applied to threat records that describe the threat's characteristics, attribution, and behavior.
All OpenSourceMalware threat records are tagged with various categories keywords that help you to better understand the threats and look for trends. For example, you can use tags to:
* Quickly filter the web UI search by keyword - search for `#tag-name` on [opensourcemalware.com](https://opensourcemalware.com/)
* Pivot on a tag within a threat record (on the website) to see all records associated with that concept
* If you're consuming the APIs, use tags from the responses to internally filter reports and set up your own workflows (e.g. alerts)
When searching by tag on the homepage, use all lowercase and replace spaces with hyphens. For example: `account-takeover` or `teampcp`, not `Account Takeover` or `TeamPCP`.
This page is not an exhaustive list of tags used in the platform. As new malware and campaigns are discovered, naturally new tags are needed.
***
## Tag categories
Our tags generally fit into these 11 categories:
| Category | Description |
| ------------------ | ----------------------------------------------------------------------- |
| Ecosystem | The registry or platform the record belongs to |
| Threat actor group | The known group responsible |
| Campaign | The named campaign this record belongs to |
| Malware family | The named malware family this payload belongs to |
| Malware type | What the malware does |
| Attacker tactic | How the attacker delivered or disguised the malware |
| Execution method | How the malware runs |
| Infrastructure | Services or platforms abused as part of the attack operation |
| Targeting | What the malware is specifically going after |
| Victim | A specific organization, platform, or technology targeted by the attack |
| Language | The human language present in the malware or package content |
***
## Ecosystem
Although the threat records are categorized by ecosystem, we also add an ecosystem tag to offer faster searches.
| Tag | Definition |
| ----------------------------------------------------------- | --------------------------------------------------- |
| [`npm`](https://opensourcemalware.com/?tag=npm) | npm package registry |
| [`pypi`](https://opensourcemalware.com/?tag=pypi) | Python Package Index |
| [`rubygems`](https://opensourcemalware.com/?tag=rubygems) | RubyGems registry |
| [`nuget`](https://opensourcemalware.com/?tag=nuget) | NuGet registry |
| [`openvsx`](https://opensourcemalware.com/?tag=openvsx) | Open VSX registry |
| [`vscode`](https://opensourcemalware.com/?tag=vscode) | VS Code Marketplace |
| [`crates`](https://opensourcemalware.com/?tag=crates) | crates.io (Rust) |
| [`maven`](https://opensourcemalware.com/?tag=maven) | Maven Central (Java) |
| [`packagist`](https://opensourcemalware.com/?tag=packagist) | Packagist (PHP/Composer) |
| [`homebrew`](https://opensourcemalware.com/?tag=homebrew) | Homebrew (macOS) |
| [`github`](https://opensourcemalware.com/?tag=github) | GitHub repository |
| [`gitlab`](https://opensourcemalware.com/?tag=gitlab) | GitLab repository |
| [`docker`](https://opensourcemalware.com/?tag=docker) | Docker Hub |
| [`go`](https://opensourcemalware.com/?tag=go) | Go module proxy |
| [`cargo`](https://opensourcemalware.com/?tag=cargo) | Cargo (Rust) - use `crates` for the registry itself |
| [`skill`](https://opensourcemalware.com/?tag=skill) | AI skills |
***
## Attribution
Attribution tags require high-confidence evidence. We break attribution into three categories:
* Threat actor group
* Campaign
* Malware family
A record can carry attribution tag types independently. For example, a confirmed malware family doesn't require a known campaign, and a known campaign doesn't require an identified threat actor group.
### Threat actor group
Threat actor group is the most challenging attribution category because most threat actors don't want to be recognized. Two that you will see frequently used in our records are:
| Tag | Definition |
| ------------------------------------------------------- | ---------------------------------------------------------- |
| [`dprk`](https://opensourcemalware.com/?tag=dprk) | North Korean state-sponsored threat actors |
| [`teampcp`](https://opensourcemalware.com/?tag=teampcp) | TeamPCP, a cloud-native financially motivated threat actor |
### Campaign
Campaign tags identify a named, tracked series of related attacks. These are some examples:
* [`glassworm`](https://opensourcemalware.com/?tag=glassworm) is an unattributed campaign first discovered in October 2025. It targets software developers by compromising popular extensions (such as for VS Code or OpenVSX) and packages across ecosystems like npm, PyPI, and GitHub.
* [`contagious-interview`](https://opensourcemalware.com/?tag=contagious-interview) (fake interviews aimed at infecting developers with malware for the purpose of stealing crypto and credentials) and [`polinrider`](https://opensourcemalware.com/?tag=polinrider) (a persistence and infection mechanism often packaged up in the Contagious Interview malware) are two related campaigns attributed to North Korean state actors.
* [`shai-hulud`](https://opensourcemalware.com/?tag=shai-hulud) was an unattributed npm worm campaign during 2025. [`mini-shai-hulud`](https://opensourcemalware.com/?tag=mini-shai-hulud) was an unrelated npm worm disseminated by TeamPCP in 2026.
* [`indonesianfoods`](https://opensourcemalware.com/?tag=indonesianfoods) was a npm spam campaign that doubled the volume of malicious npm findings in 2025.
* [`agentbaiting`](https://opensourcemalware.com/?tag=agentbaiting) is an ongoing campaign where the threat actor spreads lure repos on GitHub to trick agents into installing malware.
Where a campaign has sub-variants or waves, we may use an umbrella tag (such as [`shai-hulud`](https://opensourcemalware.com/?tag=shai-hulud)) and a specific variant tag (e.g. [`shai-hulud-second-coming`](https://opensourcemalware.com/?tag=shai-hulud-second-coming)).
### Malware family
Malware families are strains of malware that are reused by threat actors across multiple attacks or through an extended campaign. These are just some of the ones we have tagged:
| Tag | Definition |
| ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| [`beavertail`](https://opensourcemalware.com/?tag=beavertail) | DPRK infostealer delivered via Contagious Interview |
| [`ottercookie`](https://opensourcemalware.com/?tag=ottercookie) | DPRK second-stage payload associated with Contagious Interview |
| [`invisibleferret`](https://opensourcemalware.com/?tag=invisibleferret) | DPRK Python backdoor associated with Contagious Interview |
| [`weaslebiscuit`](https://opensourcemalware.com/?tag=weaslebiscuit) | An unattributed infostealer |
| [`miasma`](https://opensourcemalware.com/?tag=miasma) | A highly-aggressive variant of the Mini Shai-Hulud worm open-sourced by the threat group TeamPCP |
| [`amos-stealer`](https://opensourcemalware.com/?tag=amos-stealer) | macOS infostealer targeting browser credentials and crypto wallets |
| [`xcsset`](https://opensourcemalware.com/?tag=xcsset) | macOS malware that injects into Xcode projects |
| [`xmrig`](https://opensourcemalware.com/?tag=xmrig) | Open-source Monero miner commonly embedded in malicious packages |
***
## Malware type
This category describes what the malware does and may include several complementary tags. For example, a malicious package can be both a `dropper` and an `infostealer`.
| Tag | Definition |
| ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| [`infostealer`](https://opensourcemalware.com/?tag=infostealer) | Collects and exfiltrates sensitive data including credentials, tokens, and environment variables |
| [`backdoor`](https://opensourcemalware.com/?tag=backdoor) | Establishes persistent unauthorized remote access to the victim system |
| [`trojan`](https://opensourcemalware.com/?tag=trojan) | Malicious package disguised as or bundled with legitimate functionality |
| [`trojanized`](https://opensourcemalware.com/?tag=trojanized) | A previously legitimate package that has been modified to include malicious code |
| [`worm`](https://opensourcemalware.com/?tag=worm) | Self-propagating malware that spreads to other packages or systems without user interaction |
| [`dropper`](https://opensourcemalware.com/?tag=dropper) | Delivers and executes a secondary malicious payload |
| [`downloader`](https://opensourcemalware.com/?tag=downloader) | Fetches a remote payload but does not execute it directly |
| [`loader`](https://opensourcemalware.com/?tag=loader) | Loads and executes a payload already present on the system |
| [`rat`](https://opensourcemalware.com/?tag=rat) | Remote Access Trojan, provides interactive remote control of the victim system |
| [`cryptominer`](https://opensourcemalware.com/?tag=cryptominer) | Uses victim system resources to mine cryptocurrency |
| [`cryptostealer`](https://opensourcemalware.com/?tag=cryptostealer) | Steals victim's cryptocurrency wallets, keys, or credentials |
| [`keylogger`](https://opensourcemalware.com/?tag=keylogger) | Records keystrokes to capture credentials or other sensitive input |
| [`ransomware`](https://opensourcemalware.com/?tag=ransomware) | Encrypts victim data and demands payment for decryption |
| [`spyware`](https://opensourcemalware.com/?tag=spyware) | Passively monitors and exfiltrates victim activity |
| [`credential-theft`](https://opensourcemalware.com/?tag=credential-theft) | Targets authentication credentials specifically |
| [`wallet-stealer`](https://opensourcemalware.com/?tag=wallet-stealer) | Targets cryptocurrency wallet files or seed phrases |
`trojan` and `trojanized` are distinct. `trojan` describes a package built from scratch to appear legitimate. `trojanized` describes a package that was once legitimate and has been modified by an attacker.
***
## Attacker tactic
How the attacker delivered or disguised the malware.
| Tag | Definition |
| --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`account-takeover`](https://opensourcemalware.com/?tag=account-takeover) | A legitimate, previously trusted asset was compromised through unauthorized access to a maintainer or publisher account, regardless of how that access was obtained |
| [`name-confusion`](https://opensourcemalware.com/?tag=name-confusion) | A deceptive asset name tricks users or automated systems into installing a malicious package |
| [`dependency-confusion`](https://opensourcemalware.com/?tag=dependency-confusion) | Exploits how package managers resolve dependencies between public and private registries, causing the malicious public package to be installed instead of the intended internal one |
| [`dependency-injection`](https://opensourcemalware.com/?tag=dependency-injection) | A malicious dependency is introduced into an otherwise legitimate project |
| [`ci-poisoning`](https://opensourcemalware.com/?tag=ci-poisoning) | Malicious code is injected into a CI/CD pipeline or build configuration |
| [`social-engineering`](https://opensourcemalware.com/?tag=social-engineering) | The attacker used deception or manipulation of a person to deliver the malware or gain access (includes fake recruiter, deceptive development, and similar lures) |
`account-takeover` signals that a previously trusted package has been weaponized. When you see this tag, the package was once safe. Prioritize review of any use of this package prior to the compromise date.
### Name confusion sub-types
When applying `name-confusion`, also apply the appropriate sub-type tag.
| Tag | Definition |
| ------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| [`typosquat`](https://opensourcemalware.com/?tag=typosquat) | Exploits typographical errors or close misspellings of a legitimate asset name |
| [`brandjacking`](https://opensourcemalware.com/?tag=brandjacking) | Uses a name that appears connected to a legitimate brand, project, or ecosystem (doesn't rely on misspellings) |
| [`slopsquatting`](https://opensourcemalware.com/?tag=slopsquatting) | Registers a name that AI coding assistants hallucinate |
***
## Execution method
How the malware runs. These tags describe the mechanism of execution, not the payload behavior.
| Tag | Definition |
| ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| [`install-script`](https://opensourcemalware.com/?tag=install-script) | Malicious code executes via a package install hook (preinstall, postinstall, or equivalent) |
| [`postinstall`](https://opensourcemalware.com/?tag=postinstall) | Specifically executes via the postinstall hook |
| [`preinstall`](https://opensourcemalware.com/?tag=preinstall) | Specifically executes via the preinstall hook |
| [`import-time-execution`](https://opensourcemalware.com/?tag=import-time-execution) | Malicious code runs when the package is imported or required, without explicit invocation |
| [`ide-autorun`](https://opensourcemalware.com/?tag=ide-autorun) | Executes automatically when an IDE opens a workspace, project, or folder |
| [`entry-main`](https://opensourcemalware.com/?tag=entry-main) | Malicious code is in the package's primary entry point |
| [`obfuscation`](https://opensourcemalware.com/?tag=obfuscation) | Code has been deliberately obscured to hinder analysis |
| [`evasion`](https://opensourcemalware.com/?tag=evasion) | The malware takes active steps to avoid detection or analysis environments |
| [`persistence`](https://opensourcemalware.com/?tag=persistence) | The malware establishes a mechanism to survive reboots or re-installation |
| [`multi-stage`](https://opensourcemalware.com/?tag=multi-stage) | The malware uses more than one stage of execution, with an initial payload delivering a secondary one |
| [`dead-drop`](https://opensourcemalware.com/?tag=dead-drop) | The malware retrieves its configuration or secondary payload from a publicly accessible service rather than a dedicated C2 server |
| [`dll-hijacking`](https://opensourcemalware.com/?tag=dll-hijacking) | Exploits Windows DLL search order to load a malicious library in place of a legitimate one |
| [`lolbin`](https://opensourcemalware.com/?tag=lolbin) | Uses legitimate, trusted system binaries to execute malicious actions |
***
## Infrastructure
Services, platforms, or protocols abused as part of the attack operation. May be used for exfiltration, C2, or payload hosting.
| Tag | Definition |
| --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| [`telegram`](https://opensourcemalware.com/?tag=telegram) | Uses Telegram bots or channels for C2 or exfiltration |
| [`discord`](https://opensourcemalware.com/?tag=discord) | Uses Discord webhooks or channels for C2 or exfiltration |
| [`slack`](https://opensourcemalware.com/?tag=slack) | Uses Slack for C2 or exfiltration |
| [`vercel`](https://opensourcemalware.com/?tag=vercel) | Abuses Vercel for payload hosting or C2 |
| [`jsonkeeper`](https://opensourcemalware.com/?tag=jsonkeeper) | Uses jsonkeeper.com as a dead-drop C2 |
| [`npoint`](https://opensourcemalware.com/?tag=npoint) | Uses npoint.io as a dead-drop C2 |
| [`oast`](https://opensourcemalware.com/?tag=oast) | Uses out-of-band application security testing infrastructure for data exfiltration |
| [`solana-c2`](https://opensourcemalware.com/?tag=solana-c2) | Uses the Solana blockchain as a covert C2 channel |
| [`ethereum`](https://opensourcemalware.com/?tag=ethereum) | Uses the Ethereum blockchain for C2 or payload delivery |
| [`tron`](https://opensourcemalware.com/?tag=tron) | Uses the TRON blockchain for C2 or payload delivery |
| [`exfil-custom-c2`](https://opensourcemalware.com/?tag=exfil-custom-c2) | Exfiltrates to attacker-controlled infrastructure not covered by another tag |
| [`pastebin`](https://opensourcemalware.com/?tag=pastebin) | Uses paste sites for payload hosting or data exfiltration |
| [`ngrok`](https://opensourcemalware.com/?tag=ngrok) | Uses ngrok tunneling for C2 |
| [`cloudflare-worker`](https://opensourcemalware.com/?tag=cloudflare-worker) | Abuses Cloudflare Workers for payload delivery or C2 |
***
## Targeting
What the malware is specifically going after. This is just an example list - there are many other targets.
| Tag | Definition |
| ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| [`cryptocurrency`](https://opensourcemalware.com/?tag=cryptocurrency) | Targets cryptocurrency assets, wallets, or infrastructure |
| [`env-exfil`](https://opensourcemalware.com/?tag=env-exfil) | Targets environment variables, which commonly contain secrets, tokens, and credentials |
| [`aws`](https://opensourcemalware.com/?tag=aws) | Specifically targets AWS credentials or infrastructure |
| [`ai`](https://opensourcemalware.com/?tag=ai) | Targets AI tooling, models, agents, or AI developer workflows |
| [`solana`](https://opensourcemalware.com/?tag=solana) | Specifically targets the Solana ecosystem |
| [`polymarket`](https://opensourcemalware.com/?tag=polymarket) | Specifically targets Polymarket users or infrastructure |
| [`defi`](https://opensourcemalware.com/?tag=defi) | Targets decentralized finance protocols or infrastructure |
| [`geo-targeting`](https://opensourcemalware.com/?tag=geo-targeting) | The malware activates or behaves differently based on the victim's geographic location |
| [`developer-targeting`](https://opensourcemalware.com/?tag=developer-targeting) | Specifically crafted to target software developers rather than end users |
***
## Victim
A specific organization, platform, or technology targeted by the attack. The actual brand may be the target, or users of the brand's services. We typically use this when the record is part of a campaign directed at a named target. For example: [`aws`](https://opensourcemalware.com/?tag=aws), [`mastra`](https://opensourcemalware.com/?tag=mastra), [`anthropic`](https://opensourcemalware.com/?tag=anthropic), [`openai`](https://opensourcemalware.com/?tag=openai), [`okta`](https://opensourcemalware.com/?tag=okta), [`coinbase`](https://opensourcemalware.com/?tag=coinbase), [`redhat`](https://opensourcemalware.com/?tag=redhat).
Some tags like `aws` can appear in both Targeting and Victim depending on context.
***
## Language
The human language present in the malware or package content. Useful for attribution and clustering. For example:
| Tag | Definition |
| ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| [`lang-chinese`](https://opensourcemalware.com/?tag=lang-chinese) | Chinese language text present |
| [`lang-cyrillic`](https://opensourcemalware.com/?tag=lang-cyrillic) | Cyrillic script present (Russian, Ukrainian, Bulgarian, etc.) |
| [`lang-arabic-farsi-urdu`](https://opensourcemalware.com/?tag=lang-arabic-farsi-urdu) | Arabic script present (Arabic, Farsi, Urdu) |
| [`lang-korean`](https://opensourcemalware.com/?tag=lang-korean) | Korean language text present |
| [`lang-japanese`](https://opensourcemalware.com/?tag=lang-japanese) | Japanese language text present |
| [`lang-arabic`](https://opensourcemalware.com/?tag=lang-arabic) | Arabic specifically (use when language is confirmed as Arabic rather than Farsi or Urdu) |
| [`lang-greek`](https://opensourcemalware.com/?tag=lang-greek) | Greek language text present |
| [`lang-thai`](https://opensourcemalware.com/?tag=lang-thai) | Thai language text present |
| [`lang-hebrew`](https://opensourcemalware.com/?tag=lang-hebrew) | Hebrew language text present |
| [`lang-vietnamese`](https://opensourcemalware.com/?tag=lang-vietnamese) | Vietnamese language text present |