Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 12 of 37.
- bnpl-blocks-mobile-bnpl-action-panel@35.8.6 LWA-2026-10404T1059.007T1105T1071.001T1102T1567
- bnpl-blocks-mobile-bnpl-text-block@35.2.2 LWA-2026-10415T1059.007T1059T1105T1071.001T1102
- bnpl-blocks-utils@35.7.1 LWA-2026-10414T1059.007T1105T1071.001T1102T1082
- bigops-logs-player@35.2.8 LWA-2026-10399T1059.007T1059T1105T1071.001T1102
- bigops-shared-ui@35.1.2 LWA-2026-10398T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-independent-bnpl-preset-container@35.3.2 LWA-2026-10394T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-mobile-bnpl-image-with-caption@35.3.6 LWA-2026-10391T1059.007T1105T1071.001T1102T1059
- dolyame-ui-avatar@35.9.8 LWA-2026-10400T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-independent-bnpl-documents@35.6.6 LWA-2026-10397T1059.007T1105T1071.001T1102T1568.002
- bnpl-blocks-mobile-bnpl-separator@35.5.2 LWA-2026-10389T1059.007T1059T1105T1071.001T1102
- bnpl-blocks-mobile-bnpl-shopping-banner@35.1.4 LWA-2026-10388T1059.007T1105T1071.001T1102T1041
- dolyame-ui-action@35.6.3 LWA-2026-10401T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-independent-bnpl-main-banner@35.4.4 LWA-2026-10396T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-mobile-bnpl-footer@35.4.3 LWA-2026-10392T1105T1059.007T1059T1071.001T1102
- bnpl-blocks-mobile-bnpl-floating-button@35.3.6 LWA-2026-10393T1059.007T1059T1105T1071.001T1102
- dolyame-ui-accordion@35.2.6 LWA-2026-10402T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-mobile-bnpl-link-group@35.2.3 LWA-2026-10390T1105T1071.001T1102T1059.007T1059
- bnpl-blocks-independent-bnpl-open-api@35.1.2 LWA-2026-10395T1059.007T1105T1071.001T1573T1036
- bnpl-blocks-mobile-bnpl-documents@35.1.2 LWA-2026-10376T1105T1059.007T1071.001T1102T1082
- dolyame-boxy-stories-of-block@35.8.6 LWA-2026-10387T1059T1059.007T1105T1071.001T1071.004
- dolyame-ui-portal@35.3.6 LWA-2026-10379T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-storybook-menu@35.5.6 LWA-2026-10378T1195.002T1059T1059.007T1105T1071.001
- dolyame-ui-notification@35.5.4 LWA-2026-10380T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-mobile-bnpl-notification@35.5.6 LWA-2026-10375T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-mobile-bnpl-popup@35.5.9 LWA-2026-10374T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-desktop-bnpl-title@35.6.5 LWA-2026-10377T1059.007T1105T1071.001T1102T1573
- dolyame-ui-confirmation@35.3.3 LWA-2026-10382T1195.002T1059.007T1059.003T1105T1071.001
- bigops-activity-headers-interceptor@35.6.8 LWA-2026-10384T1059T1059.007T1105T1071.001T1102
- bigops-legacy-utils@35.2.6 LWA-2026-10386T1059.007T1059T1105T1071.001T1102
- dolyame-ui-link@35.8.5 LWA-2026-10381T1059.007T1059T1105T1071.001T1102
- bigops-api-customer@35.8.9 LWA-2026-10383T1059T1059.007T1105T1071.001T1102
- beaver-ui-side-navigation@35.7.1 LWA-2026-10385T1059.007T1105T1071.001T1102.002T1082
- bigops-api@35.8.8 LWA-2026-10373T1059.007T1059T1105T1071.001T1102
- dolyame-ui-icon@35.7.5 LWA-2026-10362T1195.002T1059.007T1105T1071.001T1102
- beaver-ui-smart-filter@35.1.9 LWA-2026-10369T1059.007T1059T1105T1071.001T1102
- beaver-ui-subheader@35.7.2 LWA-2026-10368T1059.007T1105T1071.001T1102T1059
- bi-core-bi-core-core@35.8.5 LWA-2026-10367T1059.007T1105T1071.001T1102T1059
- dolyame-ui-dropdown@35.6.2 LWA-2026-10364T1059.007T1105T1071.001T1102T1059
- dolyame-ui-constants@35.5.9 LWA-2026-10365T1059.007T1105T1071.001T1102T1059
- dolyame-ui-filter@35.5.3 LWA-2026-10363T1059T1059.007T1105T1071T1082
- dolyame-ui-checkbox@35.6.9 LWA-2026-10366T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-label@35.7.8 LWA-2026-10361T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-layout@35.9.8 LWA-2026-10360T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-money@35.6.1 LWA-2026-10358T1059.007T1105T1071.001T1102T1082
- dolyame-ui-mixins@35.1.4 LWA-2026-10359T1059.007T1105T1071.001T1102T1059
- beaver-ui-search-dropdown@35.4.5 LWA-2026-10357T1059.007T1105T1071.001T1102T1059
- bigops-alerts-widget@35.8.3 LWA-2026-10356T1059.007T1105T1071.001T1102T1059
- dolyame-ui-codemods@35.2.6 LWA-2026-10355T1059.007T1105T1071.001T1102T1059
- bigops-products-bnpl@35.2.9 LWA-2026-10353T1059.007T1059T1105T1071.001T1071.004
- bigops-products-deposits@35.9.1 LWA-2026-10352T1105T1059.007T1059T1071.001T1102
- bigops-status-selection@35.3.2 LWA-2026-10348T1059T1059.007T1105T1071.001T1102
- bigops-statements-timeline@35.2.4 LWA-2026-10349T1059.007T1059T1105T1071.001T1102
- bigops-products-timeline-commons@35.1.6 LWA-2026-10351T1059.007T1105T1071.001T1102T1059
- bigops-rx-post-message@35.1.5 LWA-2026-10350T1059.007T1105T1071.001T1102T1059
- bigops-storio@35.8.7 LWA-2026-10347T1059.007T1105T1071.001T1102T1059
- beaver-ui-multi-select-with-all@35.6.4 LWA-2026-10346T1059.007T1059T1105T1071.001T1102
- beaver-ui-pagination@35.3.7 LWA-2026-10345T1195.002T1059.007T1105T1071.001T1071.004
- bigops-products-loans@35.6.4 LWA-2026-10340T1059.007T1105T1071.001T1102T1059
- bigops-storio-store-adapter@35.9.8 LWA-2026-10334T1059.007T1059T1105T1071.001T1102
- bigops-products-mobile@35.6.8 LWA-2026-10337T1195.002T1059.007T1105T1071.001T1102
- bigops-product-list@35.8.5 LWA-2026-10343T1059.007T1059T1105T1071.001T1102
- bigops-products-insurance@35.3.4 LWA-2026-10339T1059.007T1105T1071.001T1102T1082
- bigops-products-investment@35.3.1 LWA-2026-10338T1059.007T1059T1105T1071.001T1102
- bigops-products-travel@35.7.1 LWA-2026-10336T1059.007T1059T1105T1071.001T1102
- bigops-products-accounts-and-cards@35.7.5 LWA-2026-10341T1105T1059.007T1059T1071.001T1102
- bigops-storio-ngrx@35.2.2 LWA-2026-10335T1195.002T1059.007T1105T1071.001T1102
- bigops-products@35.7.4 LWA-2026-10342T1059.007T1105T1071.001T1102T1059
- bigops-procedure-player@35.8.2 LWA-2026-10344T1059T1059.007T1105T1071.001T1102
- bigops-products-timeline@35.8.9 LWA-2026-10320T1059.007T1105T1071.001T1102T1573
- bigops-products-savings-accounts@35.3.7 LWA-2026-10321T1059.007T1105T1059T1071.001T1102
- dolyame-ui-utils@35.6.7 LWA-2026-10329T1059.007T1105T1059T1071.001T1102
- bigops-microfrontend@35.4.1 LWA-2026-10327T1059.007T1105T1071.001T1102T1041
- bigops-nitro-events-table@35.4.2 LWA-2026-10324T1105T1059.007T1059T1071.001T1102
- dolyame-ui-tabs@35.3.2 LWA-2026-10330T1195.002T1059.007T1059T1105T1071.001
- bpm-foundation-test-jest@35.9.3 LWA-2026-10325T1059T1059.007T1105T1071.001T1102
- bigops-opening-file-handler@35.9.2 LWA-2026-10322T1059.007T1105T1071.001T1102T1059
- dolyame-ui-group@35.9.7 LWA-2026-10332T1059.007T1105T1071.001T1102T1082
- dolyame-ui-styles@35.1.4 LWA-2026-10331T1059.007T1105T1071.001T1082T1059
- bigops-notes@35.8.7 LWA-2026-10323T1059T1059.007T1105T1071.001T1102
- bigops-nitro-client@35.6.1 LWA-2026-10326T1059.007T1105T1071.001T1102T1071.004
- eacq-api@35.6.1 LWA-2026-10328T1059.007T1105T1071.001T1102T1573
- dolyame-ui-editor@35.6.6 LWA-2026-10333T1059T1059.007T1105T1071.001T1102
- bigops-procedure-file-handlers@35.7.6 LWA-2026-10314T1105T1059.007T1059T1071.001T1071.004
- dolyame-ui-navigation@35.7.3 LWA-2026-10317T1059.007T1059T1105T1071.001T1102
- dolyame-ui-list@35.2.6 LWA-2026-10318T1059.007T1105T1071.001T1102T1082
- dolyame-ui-island@35.7.4 LWA-2026-10319T1195.002T1059.007T1105T1071.001T1102
- bigops-operator-status@35.4.5 LWA-2026-10315T1059.007T1059T1105T1071.001T1102
- dolyame-ui-pie@35.5.3 LWA-2026-10316T1059.007T1105T1071.001T1102T1082
- bigops-offers@35.6.8 LWA-2026-10309T1059T1105T1071.001T1102T1082
- dolyame-ui-menu@35.6.1 LWA-2026-10312T1059.007T1059T1105T1071.001T1102
- bigops-plugin-notification-builder@35.1.3 LWA-2026-10308T1059.007T1059T1105T1071.001T1102
- dolyame-ui-loader@35.1.5 LWA-2026-10313T1059.007T1105T1071.001T1102T1036
- dlab_workshop@1.0.3 LWA-2026-10307T1059.007T1082T1552.001T1041
- eacq-auth@35.4.8 LWA-2026-10310T1059.007T1105T1071.001T1102T1059
- dp-owners@35.2.6 LWA-2026-10311T1059.007T1059T1105T1071.001T1102
- dolyame-ui-scroll@35.4.3 LWA-2026-10306T1195.002T1059.007T1059T1105T1071.001
- eacq-acq-menu-core@35.9.7 LWA-2026-10296T1059T1059.007T1105T1071.001T1102
- dws-frontend-dws-frontend-core@35.4.3 LWA-2026-10298T1059T1105T1071.001T1102T1082
- dolyame-ui-text@35.7.4 LWA-2026-10302T1059.007T1105T1071.001T1102T1082
- bigops-insite@35.8.1 LWA-2026-10294T1059.007T1105T1071.001T1082T1059
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.