Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 11 of 37.
- dolyame-boxy-mobile-bnpl-title@35.1.7 LWA-2026-10503T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-markdown@35.9.4 LWA-2026-10506T1059T1059.007T1105T1071.001T1082
- dolyame-ui-button@35.9.6 LWA-2026-10501T1105T1059T1059.007T1071.001T1102
- dolyame-ui-block@35.1.8 LWA-2026-10502T1195.002T1059.007T1105T1071.001T1102
- dolyame-boxy-mobile-bnpl-image-plus-text@35.6.6 LWA-2026-10504T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-mobile-bnpl-header@35.3.6 LWA-2026-10505T1059.007T1105T1071.001T1102T1059
- bigops-outgoing-call@35.1.6 LWA-2026-10499T1105T1059.007T1059T1071.001T1071.004
- bpm-foundation-testing@35.4.3 LWA-2026-10500T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-independent-bnpl-info-slider@35.1.9 LWA-2026-10507T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-independent-bnpl-features@35.9.5 LWA-2026-10508T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-independent-bnpl-documents@35.1.7 LWA-2026-10509T1059.007T1105T1071.001T1102T1082
- dolyame-boxy-independent-bnpl-code-text@35.7.8 LWA-2026-10510T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-independent-bnpl-cards@35.7.6 LWA-2026-10511T1059.007T1105T1071.001T1071.004T1082
- dolyame-boxy-independent-bnpl-items@35.3.5 LWA-2026-10498T1059.007T1105T1071.001T1102T1059
- @dexwilt/mf-node@2.7.46 LWA-2026-10494T1195.002T1059.007
- devplatform-spa-feature-toggle@35.8.4 LWA-2026-10493T1059.007T1105T1071.001T1102T1059
- devplatform-supafetch@35.2.1 LWA-2026-10492T1105T1059T1059.007T1071.001T1102
- devplatform-spa-tokens@35.3.1 LWA-2026-10491T1059.007T1105T1071.001T1102T1082
- devplatform-utils@35.5.2 LWA-2026-10490T1059.007T1059T1105T1071.001T1102
- devplatform-spa-plugin-s3-feature-toggle@35.7.1 LWA-2026-10485T1059T1059.007T1105T1071.001T1102
- devplatform-spa-plugin-ability@35.5.2 LWA-2026-10484T1105T1059T1071.001T1102T1059.007
- devplatform-cli-spa@35.7.8 LWA-2026-10481T1059.007T1105T1071.001T1102T1082
- delivery-ci-upgrade-form@35.5.9 LWA-2026-10483T1059.007T1105T1071.001T1102T1059
- devplatform-http-client@35.8.6 LWA-2026-10479T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-component-story-name@35.3.3 LWA-2026-10480T1059.007T1105T1071.001T1082T1059
- bnpl-blocks-atom-bnpl-integrations-breadcrumbs@35.2.9 LWA-2026-10482T1059T1059.007T1105T1071.001T1102
- devplatform-vite-plugin-preserve-css-modules@35.6.8 LWA-2026-10478T1195.002T1059T1059.007T1105T1071.001
- dolyame-boxy-atom-bnpl-text@35.8.7 LWA-2026-10472T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-independent-bnpl-scheme@35.7.6 LWA-2026-10486T1105T1059T1071.004T1082
- dolyame-boxy-independent-bnpl-preset-container@35.3.7 LWA-2026-10487T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-independent-bnpl-mobile-application@35.9.2 LWA-2026-10489T1195.002T1059.007T1105T1071.001T1102
- dolyame-boxy-independent-bnpl-navigation@35.9.3 LWA-2026-10488T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-independent-bnpl-main-banner@35.2.1 LWA-2026-10477T1195.002T1059.007T1059T1105T1071.001
- dolyame-boxy-independent-bnpl-picture-gallery@35.2.6 LWA-2026-10474T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-independent-bnpl-origination@35.6.6 LWA-2026-10476T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-independent-bnpl-partners@35.9.3 LWA-2026-10475T1059.007T1105T1071.001T1102T1059
- app-hsu-layer@2.1.6 LWA-2026-10473T1059.007T1098.004T1082T1005T1041
- devplatform-rest-resources-v2@35.9.7 LWA-2026-10468T1059.007T1105T1071.001T1102T1082
- devplatform-spa-plugin-auth@35.4.5 LWA-2026-10466T1059T1105T1071.001T1102T1041
- devplatform-spa-testing@35.8.6 LWA-2026-10469T1059.007T1105T1071.001T1102T1059
- delivery-ci-validate-tinkoff-fb@35.6.9 LWA-2026-10467T1059.007T1059T1105T1071.001T1102
- devplatform-spa-plugin-analytics@35.5.7 LWA-2026-10463T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-atom-bnpl-store-button-set@35.9.5 LWA-2026-10465T1059T1105T1071.001T1102T1082
- dolyame-boxy-independent-bnpl-text-block@35.5.3 LWA-2026-10464T1195.002T1059.007T1105T1071.001T1102
- dolyame-boxy-atom-bnpl-button@35.8.3 LWA-2026-10461T1059.007T1059T1105T1071.001T1102
- delivery-ci-update-gitlab@35.7.5 LWA-2026-10462T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-atom-icon-loader@35.4.7 LWA-2026-10471T1059.007T1105T1071.001T1071.004T1059
- devplatform-nx-devkit@35.8.5 LWA-2026-10460T1195.002T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-desktop-bnpl-dangerously-html@35.9.9 LWA-2026-10470T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-desktop-bnpl-text@35.2.5 LWA-2026-10452T1059.007T1059.003T1105T1071.001T1102
- dolyame-boxy-independent-bnpl-separator@35.2.6 LWA-2026-10458T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-desktop-bnpl-highlighted-text@35.2.3 LWA-2026-10451T1059.007T1059T1105T1071.001T1102
- dolyame-boxy-independent-bnpl-title@35.7.3 LWA-2026-10454T1195.002T1059.007T1059T1105T1071.001
- dolyame-boxy-independent-bnpl-tiles@35.7.4 LWA-2026-10455T1059.007T1105T1071.001T1102T1573
- dolyame-boxy-independent-bnpl-search@35.5.6 LWA-2026-10459T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-independent-bnpl-swagger@35.6.8 LWA-2026-10457T1059T1105T1071.001T1567T1059.007
- dolyame-boxy-independent-bnpl-video@35.4.4 LWA-2026-10453T1059.007T1105T1071.001T1102T1082
- dolyame-boxy-independent-bnpl-table@35.3.4 LWA-2026-10456T1195.002T1059.007T1059T1105T1071.001
- app-kst-engine@2.1.6 LWA-2026-10450T1059.007T1082T1552.001T1041T1098
- dolyame-boxy-atom-bnpl-dolyame-button@35.7.3 LWA-2026-10449T1059.007T1105T1071.001T1102T1059
- devplatform-iam-client@35.5.6 LWA-2026-10440T1059.007T1059T1105T1071.001T1102
- delivery-ci-validate@35.1.4 LWA-2026-10438T1059.007T1059T1105T1071.001T1102
- devplatform-integrations-tests-lib@35.2.5 LWA-2026-10436T1059.007T1059T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-breadcrumbs@35.8.2 LWA-2026-10439T1059.007T1105T1071.001T1071.004T1082
- delivery-ci-microforms@35.3.5 LWA-2026-10435T1195.002T1059.007T1059T1082T1071.001
- devplatform-spa-plugin-query@35.8.5 LWA-2026-10437T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-navigation-arrow@35.2.6 LWA-2026-10434T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-radio@35.4.8 LWA-2026-10445T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-search-input@35.9.7 LWA-2026-10447T1059.007T1105T1071.001T1102T1573
- bnpl-blocks-atom-bnpl-star-rating@35.8.2 LWA-2026-10448T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-reviews-counter@35.3.6 LWA-2026-10446T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-notification@35.3.8 LWA-2026-10444T1059.007T1105T1071.001T1071.004T1059
- bnpl-blocks-atom-bnpl-popup@35.4.7 LWA-2026-10425T1195.002T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-store-button@35.2.8 LWA-2026-10430T1105T1059.007T1059T1071.001T1102
- bnpl-blocks-atom-bnpl-promocode@35.9.1 LWA-2026-10426T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-container@35.7.4 LWA-2026-10433T1059.007T1059T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-toggle@35.2.4 LWA-2026-10432T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-skeleton@35.6.3 LWA-2026-10429T1195.002T1059T1059.007T1105T1071.001
- bnpl-blocks-atom-bnpl-review@35.5.4 LWA-2026-10428T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-range@35.6.6 LWA-2026-10427T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-text@35.8.8 LWA-2026-10431T1059.007T1105T1071.001T1102T1082
- devplatform-translate@35.5.3 LWA-2026-10424T1105T1071.001T1102T1059.007T1059
- bnpl-blocks-atom-bnpl-anchor-menu@35.8.5 LWA-2026-10423T1195.002T1059T1059.007T1105T1071.001
- devplatform-nx-ts@35.1.3 LWA-2026-10422T1059T1059.007T1105T1071.001T1102
- devplatform-cli-plugin-generator@35.3.5 LWA-2026-10421T1059.007T1059T1105T1071.001T1102
- dolyame-boxy-atom-desktop-bnpl-highlighted-text@35.5.6 LWA-2026-10420T1059.007T1059T1105T1071.001T1102
- delivery-ci-tech-holder@35.3.4 LWA-2026-10419T1059T1059.007T1105T1071.001T1567
- devplatform-react-query-s3-client@35.8.7 LWA-2026-10418T1059.007T1105T1071.001T1102T1567
- dolyame-boxy-atom-desktop-bnpl-container@35.3.3 LWA-2026-10417T1059.007T1059T1105T1071.001T1102
- devplatform-confirm-input@35.9.8 LWA-2026-10416T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-desktop-bnpl-anchor-title@35.2.5 LWA-2026-10410T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-desktop-bnpl-text-block@35.9.4 LWA-2026-10407T1059.007T1105T1071.001T1102T1041
- devplatform-di@35.5.5 LWA-2026-10413T1059.007T1059T1105T1071.001T1102
- devplatform-cli-contracts@35.7.3 LWA-2026-10412T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-desktop-bnpl-category-gallery@35.2.8 LWA-2026-10409T1059.007T1105T1071.001T1102T1568.002
- bnpl-blocks-desktop-bnpl-header-search@35.2.6 LWA-2026-10408T1059.007T1105T1071.001T1071.004T1059
- bnpl-blocks-independent-bnpl-features@35.7.2 LWA-2026-10406T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-atom-bnpl-product-card@35.6.4 LWA-2026-10411T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-independent-bnpl-navigation@35.8.4 LWA-2026-10405T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-mobile-bnpl-faq@35.5.3 LWA-2026-10403T1195.002T1059.007T1106T1105T1071.001
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.