Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 14 of 37.
- dolyame-ui-slider@35.3.7 LWA-2026-10200T1195.002T1059.007T1059T1082T1105
- bigops-web-analytics@35.9.4 LWA-2026-10197T1059T1059.007T1105T1071.001T1102
- beaver-ui-table@35.2.7 LWA-2026-10194T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-react-wrapper@35.4.2 LWA-2026-10195T1059.007T1105T1071.001T1102T1082
- dolyame-ui-test@35.2.5 LWA-2026-10191T1059.007T1059T1105T1071.001T1102
- dolyame-ui-select@35.9.5 LWA-2026-10192T1195.002T1059.007T1059T1105T1071.001
- dolyame-ui-skeleton@35.2.5 LWA-2026-10193T1059.007T1105T1071.001T1102T1059
- dolyame-ui-pagination@35.2.5 LWA-2026-10190T1059.007T1105T1071.001T1102T1059
- devplatform-api-v2-endpoint@35.6.7 LWA-2026-10186T1059.007T1105T1071.001T1102T1082
- deposits-common@35.5.4 LWA-2026-10185T1059.007T1059T1105T1071.001T1102
- devplatform-spa-cli@35.9.2 LWA-2026-10182T1059.007T1105T1071.001T1102T1059
- devplatform-nx-stylelint@35.6.9 LWA-2026-10181T1195.002T1059.007T1105T1071.001T1102
- devplatform-spa-plugin-beaver@35.2.2 LWA-2026-10183T1059.007T1105T1071.001T1102T1059
- devplatform-api-clients@35.6.8 LWA-2026-10184T1059T1105T1071.001T1102T1082
- devplatform-test-pvm-is-odd@35.3.9 LWA-2026-10180T1059.007T1105T1071.001T1027
- devplatform-nx-gle@35.5.3 LWA-2026-10179T1059T1059.007T1105T1071.001T1102
- delivery-ci-pipeline-rules@35.9.3 LWA-2026-10178T1059.007T1105T1071.001T1102T1082
- dolyame-boxy-atom-bnpl-info-card@35.5.5 LWA-2026-10177T1059T1105T1071.001T1102T1041
- devplatform-spa-plugin-module@35.7.9 LWA-2026-10176T1059.007T1059T1105T1071.001T1102
- delivery-ci-upgrade-from@35.6.9 LWA-2026-10175T1059.007T1105T1071.001T1102T1059
- dolyame-ui-popover@35.8.7 LWA-2026-10174T1195.002T1059.007T1059T1105T1071.001
- dolyame-ui-flag@35.7.6 LWA-2026-10173T1059T1059.007T1105T1071.001T1008
- dolyame-ui-input@35.7.6 LWA-2026-10171T1195.002T1059.007T1059.003T1105T1071.001
- docsmate-docsmate-core@35.9.3 LWA-2026-10168T1059.007T1105T1071.001T1102T1059
- delivery-ci-notify@35.2.5 LWA-2026-10172T1059.007T1105T1071.001T1102T1041
- delivery-ci-sage@35.6.3 LWA-2026-10169T1059.007T1105T1071.001T1102T1059
- dolyame-ui-radio@35.2.2 LWA-2026-10167T1059.007T1105T1071.001T1102T1059
- devplatform-rest-client@35.7.9 LWA-2026-10170T1059.007T1105T1071.001T1082T1059
- delivery-ci-storyshots@35.3.6 LWA-2026-10166T1059T1059.007T1105T1071.001T1102
- devplatform-react-scripts@35.2.9 LWA-2026-10164T1195.002T1059.007T1059T1082T1105
- devplatform-spa@35.1.4 LWA-2026-10165T1195.002T1059.007T1105T1071.001T1102
- devplatform-hooks@35.2.1 LWA-2026-10163T1059.007T1059T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-action-card@35.4.7 LWA-2026-10158T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-analytics@35.3.8 LWA-2026-10157T1059.007T1105T1071.001T1102T1082
- bnpl-blocks-atom-bnpl-image-popup@35.9.6 LWA-2026-10160T1195.002T1059.007T1105T1071.001T1071.004
- bigops-watchdog-worker@35.7.4 LWA-2026-10162T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-image@35.2.9 LWA-2026-10161T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-carousel-line@35.1.6 LWA-2026-10159T1059.007T1059T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-base-popup@35.2.9 LWA-2026-10156T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-no-index-link@35.1.2 LWA-2026-10154T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-link-avatar@35.4.8 LWA-2026-10153T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-dangerously-html@35.2.4 LWA-2026-10214T1105T1071.001T1102T1059.007T1059.004
- bnpl-blocks-atom-bnpl-fade-overflow@35.7.2 LWA-2026-10155T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-card@35.9.4 LWA-2026-10152T1059.007T1105T1071.001T1071.004T1059
- bnpl-blocks-atom-bnpl-dolyame-button@35.1.8 LWA-2026-10151T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-dropdown@35.5.5 LWA-2026-10215T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-button@35.4.7 LWA-2026-10150T1059T1059.007T1105T1071.001T1102
- blocks-sahred-atom-mobile-app-bar-action@35.6.8 LWA-2026-10148T1195.002T1059.007T1059T1082T1105
- bnpl-blocks-atom-bnpl-email-form@35.3.9 LWA-2026-10149T1059.007T1059.003T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-badge@35.6.8 LWA-2026-10147T1059.007T1105T1071.001T1102T1059
- bnpl-api@35.9.5 LWA-2026-10138T1059.007T1059T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-info-card@35.7.3 LWA-2026-10137T1059.007T1105T1071.001T1082T1059
- bnpl-blocks-atom-bnpl-feedback@35.7.5 LWA-2026-10139T1059.007T1105T1071.001T1102T1082
- bigops-watermark@35.9.5 LWA-2026-10134T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-news-card@35.6.8 LWA-2026-10135T1195.002T1059.007T1105T1071.001T1102
- bigops-watchdog-angular@35.4.8 LWA-2026-10136T1059.007T1105T1071.001T1102T1082
- bigops-tasks@35.1.4 LWA-2026-10133T1059T1059.007T1105T1071.001T1102
- bigops-utils@35.4.8 LWA-2026-10131T1059.007T1105T1071.001T1102T1573
- bigops-tcrm-auth@35.8.5 LWA-2026-10132T1059T1059.007T1105T1071.001T1102
- bigops-timeline-ui@35.5.8 LWA-2026-10130T1059T1059.007T1105T1071.001T1102
- bigops-telephony-ui@35.7.3 LWA-2026-10129T1059.007T1105T1071.001T1102T1059
- bigops-telephony@35.8.4 LWA-2026-10128T1059.007T1105T1071.001T1102T1059
- bigops-tcrm-permissions@35.5.1 LWA-2026-10127T1195.002T1059.007T1059T1105T1071.001
- bigops-ui-kit-styles@35.5.7 LWA-2026-10124T1059.007T1105T1071.001T1102T1059
- bigops-timers@35.9.5 LWA-2026-10125T1059.007T1059T1105T1071.001T1102
- bigops-tcrm-identity-auth@35.9.3 LWA-2026-10126T1059T1059.007T1105T1071.001T1102
- bigops-videocalls@35.9.9 LWA-2026-10122T1059T1105T1071.001T1102
- bigops-ui-themes@35.6.5 LWA-2026-10123T1059.007T1059T1105T1071.001T1102
- bigops-tinkoff-telephony-mock@35.5.1 LWA-2026-10121T1059.007T1105T1071.001T1102T1082
- bigops-telephony-client@35.7.6 LWA-2026-10120T1105T1059T1059.007T1071.001T1071.004
- bigops-telephony-ui-adapter@35.6.4 LWA-2026-10119T1059.007T1105T1071.001T1102T1082
- bigops-ui-kit@35.9.2 LWA-2026-10118T1059.007T1105T1071.001T1102T1082
- bigops-timeline@35.4.9 LWA-2026-10117T1059T1105T1071.001T1102T1082
- bigops-tslint@35.9.4 LWA-2026-10115T1195.002T1059T1059.007T1105T1071.001
- bigops-tasks-client@35.1.2 LWA-2026-10116T1105T1059T1059.007T1071T1102
- bigops-stylelint@35.4.3 LWA-2026-10114T1195.002T1059.007T1105T1071.001T1102
- bigops-umf-statist@35.3.1 LWA-2026-10113T1059.007T1059.003T1105T1071.001T1102
- @lizhao1/memorax-code-internal@0.1.2 LWA-2026-10112T1059.007T1547T1082T1071.001T1041
- @zahlen/checkout-angular@0.1.4 LWA-2026-10111T1059.007T1105T1071.001T1102T1573
- @zahlen/checkout-react@0.1.1 LWA-2026-10110T1059.007T1105T1071.001T1102T1082
- @zahlen/checkout@0.2.2 LWA-2026-10109T1059.007T1105T1071.001T1102T1573
- simplipayng@1.0.8 LWA-2026-10108T1059.007T1105T1071T1082T1102
- @diezyyasha/libsignal-node@2.2.8 LWA-2026-10107T1195.002T1059.007T1574.002T1078
- foodi@99.99.1 LWA-2026-10106T1195.002T1059.007T1082T1552.001T1041
- @simplipayng/checkout@1.4.3 LWA-2026-10105T1059.007T1105T1071T1102T1573
- github-app-sts-action@1.0.1 LWA-2026-10104T1059.007T1082T1041T1071.001
- @nasddatax/common@1.0.21 LWA-2026-10103T1059.007T1105T1071.001T1102T1573
- @hoteldev/common@1.0.9 LWA-2026-10101T1059.007T1105T1071.001T1102T1573
- @vboxdev/common@1.0.73 LWA-2026-10100T1059.007T1071.001T1573T1105T1102
- streak-calc-metrics@1.0.0 LWA-2026-10102T1059T1059.007T1105T1071T1573
- karapace-docs@1.0.1 LWA-2026-10099T1059.007T1082T1071.001T1041
- eslint-plugin-vitest-ts@1.0.4 LWA-2026-10098T1195.002T1059.007T1105T1573T1059
- devpack-conf@5.0.0 LWA-2026-10097T1195.002T1059.007T1105T1071.001T1102
- tailwind-hide-scrollbar@2.1.5 LWA-2026-10096T1059.007T1059T1102T1071.001T1105
- streak-calc-math@1.0.0 LWA-2026-10095T1059T1059.007T1105T1071T1573
- streak-math-calc@1.0.0 LWA-2026-10094T1059T1059.007T1105T1071T1573
- @rentwise/common@1.0.36 LWA-2026-10092T1059.007T1105T1071.001T1102T1041
- @nasdtickets/common@1.0.23 LWA-2026-10093T1059.007T1105T1071.001T1102T1082
- tailwindcss-scrollbar-hide@2.2.6 LWA-2026-10091T1059.007T1105T1071.001T1573T1041
- ethers-lib@1.0.3 LWA-2026-10089T1195.002T1059.007T1082T1552.001T1005
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.