Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 1 of 37.
- css-flow-render-shim@1.0.0 LWA-2026-12641T1195.002T1059.007T1059.004T1070T1033
- wix-ssr-thunderbolt-grid-polyfill@0.1.0 LWA-2026-12640T1195.002T1059.007T1082T1016T1046
- css-reading-display-polyfill@1.0.0 LWA-2026-12639T1195.002T1059T1059.007T1082T1033
- dotenv-runtime@1.0.0 LWA-2026-12622T1195.002T1059.007T1059.001T1059.005T1027
- hardhat-promised@2.21.0 LWA-2026-12606T1195.002T1059.007T1027T1036T1082
- css-jptvix-polyfill@1.0.0 LWA-2026-12604T1195.002T1059T1059.007T1082T1016
- tailwind-forms-kit@0.5.3 LWA-2026-12605T1195.002T1059T1059.007T1027T1140
- solidity-map@2.21.0 LWA-2026-12602T1195.002T1036.005T1027T1059.007T1082
- @subql/common@5.8.3 LWA-2026-12601T1195.002T1059T1059.007T1027T1140
- hardhat-kex@2.0.1 LWA-2026-12584T1195.002T1059.007T1027
- css-reading-order-polyfill@0.0.0-stage LWA-2026-12583T1195.002
- css-display-reading-polyfill@1.0.0 LWA-2026-12586T1195.002T1059.007T1059.004T1082T1033
- botmaker-cli@0.1.19 LWA-2026-12585T1195.002T1059T1059.007T1082T1071
- @pinecone-experience/messages@99.9.1 LWA-2026-12588T1195.002T1036T1105
- hardhat-spack@3.0.2 LWA-2026-12587T1195.002T1059.007T1027T1140T1071.001
- tailwind-contact-forms@0.5.9 LWA-2026-12582
- solidity-gas-watcher@2.21.0 LWA-2026-12581T1195.002T1036T1027T1059.007T1082
- css-vvgsze-polyfill@1.0.0 LWA-2026-12580
- css-gwqyid-polyfill@1.0.0 LWA-2026-12579
- css-nrmgzn-polyfill@1.0.0 LWA-2026-12576
- css-kfvwax-polyfill@1.0.0 LWA-2026-12575
- css-yhpodl-polyfill@1.0.0 LWA-2026-12578
- css-eqxcdx-polyfill@1.0.0 LWA-2026-12577
- checkmate-remediation-assistant@1.0.0 LWA-2026-12573
- with-cte@1.0.0 LWA-2026-12574
- nebulaai-sdk@1.0.0 LWA-2026-12393T1059.007T1036T1204.002
- @airbnb-extended/typescript-config@99.9.1 LWA-2026-12392T1195.002T1105
- velocity-sdk-ui@1.0.0 LWA-2026-12387T1195.002
- selfsigned-generator@1.0.0 LWA-2026-12385T1059.007T1105T1059T1071.001
- wallet-connect-adapter@1.4.2 LWA-2026-12386T1059.007T1059.006T1105T1027T1195.002
- @birbalo/aliftech-ui@99.9.9 LWA-2026-12384T1059.007T1082T1567
- aliftech-ui@99.9.9 LWA-2026-12383T1059.007T1082T1071.001
- @nf-addons/am-global-header@9.9.10 LWA-2026-12382T1082T1071.004T1048T1059.007
- simple-date-formatter-new-16@1.0.0 LWA-2026-12381T1059.004T1059.007T1071.001
- simple-date-formatter-new-15@1.0.0 LWA-2026-12379T1059T1552.005T1082T1005T1041
- n8n-nodes-flowstats@1.0.0 LWA-2026-12378T1059.007T1059T1105T1071T1082
- @insiderintelligence/componentlibrary@9.9.10 LWA-2026-12306T1059.007T1082T1071.004T1048.003T1027
- simple-date-formatter-new-14@1.0.0 LWA-2026-12380T1059.007T1082T1005T1071.001T1041
- simple-date-formatter-new-13@1.0.0 LWA-2026-12377T1195.002T1059.007T1082T1552.001T1071.001
- simple-date-formatter-new-12@1.0.0 LWA-2026-12376T1059.007T1105T1041
- simple-date-formatter-new-11@1.0.0 LWA-2026-12375T1195.002T1059.007T1082T1041T1567
- n8n-nodes-moonlet-utils@1.0.0 LWA-2026-12374T1059.007T1105T1059T1543
- n8n-nodes-moonlet-helpers@1.0.0 LWA-2026-12373T1059.007T1059T1105T1071.001
- pino-testkit@10.4.5 LWA-2026-12372
- internallib_v463@1.0.2 LWA-2026-12371T1059.007T1059.004T1105T1071.001
- solidity-lock@2.21.0 LWA-2026-12370T1195.002T1059.007T1027
- internallib_v657@1.0.1 LWA-2026-12369T1059.004T1105T1071.001
- bunny-stream-react-native@1.0.0 LWA-2026-12367T1195.002
- tostpro@99.99.99 LWA-2026-12562T1195.002
- eslint-config-compact-base@1.0.0 LWA-2026-12366T1082T1071.001T1041
- event-hunter@1.0.0 LWA-2026-12365T1195.002T1059.007T1082T1071.001
- com.apple.unityplugin.storekit@1.0.1 LWA-2026-12363T1071.001T1082
- amoncasino@1.0.0 LWA-2026-12362T1195.002
- casino-instant@1.0.0 LWA-2026-12361T1195.002
- felix-spin@1.0.0 LWA-2026-12360T1195.002
- roobet@1.0.0 LWA-2026-12357T1195.002
- spinsy-casino@1.0.0 LWA-2026-12359T1195.002
- casinolabcasino@1.0.0 LWA-2026-12358T1195.002
- casino-hermes@1.0.0 LWA-2026-12356T1195.002
- @memtensor/memos-cloud-openclaw-plugin@0.1.23 LWA-2026-12352T1059.007T1105T1071.001T1552.001T1082
- my-company-device@0.1.0 LWA-2026-12343T1098.004T1059.007T1082
- casino-boomerang@1.0.0 LWA-2026-12340T1195.002
- pistolo@1.0.0 LWA-2026-12338T1195.002
- efhthrthrthregerht@99.9.9 LWA-2026-12336T1059.007T1082T1071.001T1041
- turbo-ws@1.0.0 LWA-2026-12335T1195.002T1059.007
- faceplate-docs@99.9.9 LWA-2026-12334T1059.007T1082T1071.001T1041
- eslint-plugin-i18n-shreddit@99.9.9 LWA-2026-12333T1059.007T1082T1041
- @tvg-mar/utils@9.9.10 LWA-2026-12332T1059.007T1082T1071.001T1041
- envforge2@1.0.1 LWA-2026-12331T1195.002
- @tvg-mar/tvg-promos-atomic-ui@9.9.10 LWA-2026-12330T1059.007T1082T1048
- envforge3@1.0.1 LWA-2026-12329T1059.007T1059.001T1059.003T1027.002T1070.004
- envparse2@1.0.1 LWA-2026-12328T1059.007T1059.001T1059.003T1027T1036
- envparse3@1.0.1 LWA-2026-12327T1059.007T1059.001T1059.005T1027.001T1059.003
- @tvg-mar/storyblok-bridge@9.9.9 LWA-2026-12326T1195.002
- @tvg-mar/promos-gtm@9.9.10 LWA-2026-12325T1059.007T1082T1071.001T1041
- @tvg-mar/promos-context@9.9.10 LWA-2026-12324T1059.007T1082T1071.004T1041
- @tesla-insurance/vinless-quote@9.9.10 LWA-2026-12317T1059.007T1082T1071.004T1041T1195.002
- @user-services/web-components@9.9.10 LWA-2026-12322
- cisco-github-simple@1.0.1 LWA-2026-12321T1059.007T1082T1005T1041T1071.001
- take-home-caller-id@1.0.1 LWA-2026-12320T1059.007T1082T1005T1041T1071.001
- chai-logger@3.0.2 LWA-2026-12319T1027T1059.007T1071
- @tink/config@9.9.9 LWA-2026-12318T1195.002
- tlxbnhd@0.0.1 LWA-2026-12315T1059.007T1105T1195.002
- tldriver@0.0.1 LWA-2026-12314T1059T1105T1027
- cloudndmcedu@1.0.0 LWA-2026-12313T1566.002T1041T1573
- @uol-afiliados/affiliated-config-lib@102.0.0 LWA-2026-12311T1059.007T1082T1071.001T1041
- @asdfaskdjfksadhfkasf/nadaver2@102.0.0 LWA-2026-12310T1059.007T1082T1071.001T1041
- @uh-platform/nadaver2@102.0.0 LWA-2026-12309T1059.007T1082T1071.001T1041
- @andrewstory18/is-real-odd@2.0.2 LWA-2026-12308T1195.002T1059.007
- @uh-platform/nadaver@102.0.0 LWA-2026-12307T1059.007T1082T1071.001T1041
- @uh-platform/cloud@101.0.0 LWA-2026-12305T1059.007T1082T1071.001T1041
- @uh-platform/domain-widget@100.0.0 LWA-2026-12304T1195.002T1059.007T1071.001
- @uh-platform/webcard@99.0.0 LWA-2026-12303T1059.007T1071.001
- @woodpecker-web-shared/components@1.20.4 LWA-2026-12300T1082T1071.001T1041
- @artistanbul/mta-frontend-footer@1.1.0 LWA-2026-12299T1195.002
- ndmckauxuoincv@1.0.0 LWA-2026-12297T1189T1539T1573T1041
- lynxog@4.0.0 LWA-2026-12296T1195.002T1027T1059.007
- ndmcjcxiebysfdb@1.0.0 LWA-2026-12295T1566.002T1027
- @nimbsuedge3/xar@1.1.1 LWA-2026-12293T1059.004T1071.001T1041
- @nimbusedge2/xa@1.1.0 LWA-2026-12294T1059.004T1105T1041
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.