Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 13 of 37.
- beaver-ui-popover-card@35.4.4 LWA-2026-10295T1059.007T1105T1071.001T1102T1567
- dp-web-header@35.3.8 LWA-2026-10299T1059.007T1105T1071.001T1102T1059
- bigops-legacy-telephony-panel@35.5.7 LWA-2026-10293T1059.007T1059T1105T1071.001T1102
- dolyame-ui-toggle@35.4.1 LWA-2026-10300T1195.002T1059.007T1059T1082T1105
- dolyame-ui-textarea@35.3.4 LWA-2026-10301T1059.007T1105T1071.001T1102T1059
- dwsai-dwsai-core@35.8.4 LWA-2026-10297T1105T1059.007T1071.001T1102T1059
- dolyame-ui-table@35.5.4 LWA-2026-10304T1059T1059.007T1105T1071.001T1102
- dolyame-ui-tag@35.9.9 LWA-2026-10303T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-swiper@35.7.7 LWA-2026-10305T1059T1059.007T1105T1071.001T1102
- dolyame-ui-themes@35.6.3 LWA-2026-10292T1059.007T1105T1071.001T1102T1082
- dolyame-ui-tooltip@35.8.8 LWA-2026-10291T1195.002T1059.007T1105T1071.001T1071.004
- eacq-acq-menu@35.2.1 LWA-2026-10289T1059.007T1105T1071.001T1102T1059
- dolyame-ui-types@35.8.2 LWA-2026-10290T1195.002T1059.007T1105T1071.001T1071.004
- devplatform-po-transformer@35.1.8 LWA-2026-10287T1059T1059.007T1105T1071.001T1071.004
- devplatform-jscodeshift-utils@35.3.8 LWA-2026-10286T1059.007T1105T1071.001T1102T1082
- devplatform-api-v2-resource-mock@35.4.1 LWA-2026-10288T1059.007T1105T1071.001T1102T1059
- devplatform-react-form@35.8.3 LWA-2026-10285T1059.007T1059T1105T1071.001T1102
- devplatform-po-loader@35.1.8 LWA-2026-10284T1059.007T1105T1071.001T1102T1059
- devplatform-spa-ui@35.8.2 LWA-2026-10283T1059.007T1059T1105T1071.001T1071.004
- devplatform-spa-plugin-devtools@35.5.6 LWA-2026-10280T1059.007T1105T1071.001T1102T1059
- devplatform-spa-plugin-s3-module-loader@35.8.2 LWA-2026-10282T1059.007T1105T1071.001T1102.001T1564.001
- devplatform-api-v2-resources@35.3.8 LWA-2026-10278T1059.007T1105T1071.001T1102T1082
- devplatform-ui-notification@35.3.6 LWA-2026-10281T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-atom-bnpl-dangerously-html@35.5.4 LWA-2026-10279T1059T1059.007T1105T1071T1071.001
- devplatform-spa-plugin-root-devtools@35.5.6 LWA-2026-10277T1059.007T1059T1105T1071.001T1102
- devplatform-npm-versions-checker@35.5.9 LWA-2026-10276T1059T1059.007T1105T1071.001T1102
- delivery-ci-storybook@35.5.8 LWA-2026-10275T1105T1071.001T1102T1059.007T1059
- devplatform-spa-plugin-sentry@35.1.1 LWA-2026-10274T1059.007T1105T1071.001T1102T1082
- dolyame-boxy-desktop-bnpl-button-set@35.2.4 LWA-2026-10273T1059.007T1105T1071.001T1102T1082
- devplatform-spa-plugin-module-loader@35.8.5 LWA-2026-10271T1059.007T1059T1105T1071.001T1102
- devplatform-spa-di@35.5.8 LWA-2026-10272T1059T1059.007T1105T1071.001T1102
- dolyame-ui-footer@35.5.8 LWA-2026-10269T1195.002T1059.007T1059T1105T1071.001
- devplatform-spa-plugin-thermostat@35.9.9 LWA-2026-10265T1059.007T1105T1071.001T1102T1082
- devplatform-vite-plugin-gle@35.3.9 LWA-2026-10267T1059.007T1059T1105T1071.001T1102
- devplatform-s3-uploader@35.4.4 LWA-2026-10270T1059.007T1059T1105T1071.001T1102
- devplatform-spa-plugin-s3@35.5.9 LWA-2026-10266T1059.007T1059T1105T1071.001T1102
- devplatform-po-declaration-generator@35.2.7 LWA-2026-10268T1059T1105T1071.001T1102T1082
- dolyame-boxy-atom-icon-loader@35.1.8 LWA-2026-10264T1059.007T1105T1071.001T1102T1082
- devplatform-table@35.7.6 LWA-2026-10262T1195.002T1059.007T1105T1071.001T1102
- devplatform-spa-plugin-location@35.9.2 LWA-2026-10261T1059.007T1059.003T1105T1071.001T1102.002
- dolyame-boxy-atom-desktop-bnpl-dangerously-html@35.4.8 LWA-2026-10263T1059.007T1105T1071.001T1102T1059
- devplatform-select-user@35.4.4 LWA-2026-10260T1059T1059.007T1105T1071.001T1102
- devplatform-spa-plugin-error-boundary@35.4.6 LWA-2026-10259T1105T1059T1071T1102T1059.007
- devplatform-select-fields@35.2.6 LWA-2026-10258T1059.007T1105T1071.001T1102T1568
- devplatform-s3-client@35.9.5 LWA-2026-10257T1059.007T1105T1071.001T1102T1082
- devplatform-snarkdown@35.2.1 LWA-2026-10256T1195.002T1059.007T1105T1071.001T1071.004
- devplatform-nx-husky@35.7.7 LWA-2026-10255T1059.007T1105T1071.001T1102T1567
- devplatform-spa-route-tree@35.1.3 LWA-2026-10254T1059T1059.007T1105T1071.001T1102
- devplatform-prettier-config@35.1.3 LWA-2026-10253T1059.007T1105T1071.001T1102T1568.002
- devplatform-spa-plugin-root-sentry@35.4.5 LWA-2026-10252T1059.007T1105T1071.001T1071.004T1059
- devplatform-spa-plugin-i18next-instance@35.5.9 LWA-2026-10249T1059.007T1105T1071.001T1102T1568.002
- dolyame-boxy-atom-bnpl-popup@35.9.3 LWA-2026-10250T1059.007T1105T1071.001T1102T1071.004
- devplatform-spa-devtools@35.2.6 LWA-2026-10251T1059T1059.007T1105T1071.001T1071
- devplatform-cra-template@35.6.2 LWA-2026-10248T1059.007T1059T1105T1071.001T1102
- dolyame-boxy-block@35.5.2 LWA-2026-10247T1195.002T1059T1059.007T1105T1071.001
- devplatform-react-micro-frontend@35.2.1 LWA-2026-10246T1059.007T1059T1105T1071.001T1102
- dlp-dlp-core@35.1.3 LWA-2026-10242T1059.007T1105T1071.001T1102T1059
- dippy-invertor@35.1.6 LWA-2026-10245T1059.007T1105T1071.001T1071.004T1059
- dolyame-ui-grid@35.7.4 LWA-2026-10243T1059T1105T1071.001T1048T1082
- devplatform-api-v2-resources-metadata@35.7.7 LWA-2026-10244T1059.007T1059.004T1105T1071.001T1102
- dolyame-ui-container@35.3.7 LWA-2026-10241T1195.002T1059.007T1105T1071.001T1102
- devplatform-vite-plugin-external@35.3.6 LWA-2026-10240T1059.007T1105T1071.001T1102T1059
- devplatform-cli@35.7.4 LWA-2026-10238T1059.007T1105T1071.001T1102T1059
- devplatform-spa-plugin-cobrowsing@35.4.4 LWA-2026-10235T1059.007T1105T1071.001T1102T1082
- dolyame-ui-checkable@35.4.1 LWA-2026-10236T1195.002T1059T1105T1071.001T1102
- devplatform-nx-spa@35.8.7 LWA-2026-10237T1059T1059.007T1105T1071.001T1102
- devplatform-auth-client@35.2.1 LWA-2026-10234T1059.007T1105T1071.001T1048.003T1082
- devplatform-humanize-network-error@35.3.8 LWA-2026-10233T1059.007T1105T1071.001T1102T1059
- devplatform-sdk@35.6.1 LWA-2026-10231T1059.007T1059T1105T1071.001T1102
- dolyame-ui-draggable@35.4.6 LWA-2026-10230T1195.002T1059T1105T1071.001T1102
- delivery-ci-unit@35.9.3 LWA-2026-10228T1059T1059.007T1105T1071.001T1102
- devplatform-spa-plugin-dom-render@35.5.5 LWA-2026-10229T1059T1105T1071.001T1102T1036
- devplatform-i18n@35.6.2 LWA-2026-10227T1059.007T1105T1071.001T1102T1071.004
- devplatform-sre-devplatform-sre-core@35.1.8 LWA-2026-10232T1059.007T1105T1071.001T1102T1059
- devplatform-spa-plugin-history@35.1.4 LWA-2026-10226T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-atom-bnpl-image-card@35.7.7 LWA-2026-10224T1059.007T1105T1071.001T1071.004T1059
- devplatform-nx-react@35.9.4 LWA-2026-10222T1059.007T1105T1071.001T1102T1082
- dolyame-boxy-atom-container@35.3.2 LWA-2026-10225T1059T1105T1071.001T1102T1082
- devplatform-react-query-clients@35.7.7 LWA-2026-10223T1059T1105T1071.001T1102T1567
- bigops-storio-ngrx-component-store@35.3.4 LWA-2026-10221T1195.002T1059.007T1105T1071.001T1102
- devplatform-data-table@35.4.1 LWA-2026-10219T1195.002T1059.007T1105T1071.001T1102
- dolyame-boxy-atom-bnpl-badge@35.2.3 LWA-2026-10217T1059.007T1105T1071.001T1102T1082
- devplatform-zod-wip-api@35.9.3 LWA-2026-10220T1059T1059.007T1105T1071.001T1102
- devplatform-spa-use-track@35.5.3 LWA-2026-10218T1059.007T1105T1071.001T1102T1059
- devplatform-create-nx-spa@35.4.9 LWA-2026-10212T1059T1059.007T1105T1071.001T1071.004
- dolyame-boxy-desktop-bnpl-hero-title@35.4.2 LWA-2026-10213T1059T1105T1071.001T1567T1082
- devplatform-cli-plugin-test@35.4.5 LWA-2026-10210T1059.007T1105T1071.001T1071T1102
- devplatform-nx-pvm@35.2.9 LWA-2026-10209T1059.007T1105T1071.001T1102T1573
- devplatform-rest-resources-v1@35.2.3 LWA-2026-10211T1059T1059.007T1105T1071.001T1102
- devplatform-ui-kit@35.6.2 LWA-2026-10207T1105T1059.007T1059T1071.001T1102
- delivery-ci-quality@35.6.2 LWA-2026-10208T1059.007T1059T1105T1071.001T1102
- devplatform-s3-resources@35.5.1 LWA-2026-10206T1195.002T1059.007T1059T1105T1071.001
- devplatform-spa-plugin-notifier@35.5.7 LWA-2026-10205T1059.007T1059T1105T1071.001T1082
- devplatform-api-endpoint@35.2.9 LWA-2026-10204T1059T1059.007T1105T1071.001T1102
- devplatform-react-hooks@35.5.7 LWA-2026-10202T1059.007T1105T1071.001T1102T1082
- dolyame-boxy-desktop-bnpl-card-gallery@35.5.2 LWA-2026-10203T1059.007T1059T1105T1071.001T1102
- dolyame-boxy-atom-bnpl-card@35.5.5 LWA-2026-10201T1195.002T1059.007T1105T1071.001T1102
- devplatform-test-pvm-is-even@35.9.5 LWA-2026-10199T1059.007T1059T1105T1071.001T1102
- devplatform-cli-plugin-lint@35.5.1 LWA-2026-10198T1059.007T1105T1071.001T1102T1082
- devplatform-nx-svelte@35.6.8 LWA-2026-10196T1059T1059.007T1105T1071.001T1102
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.