Confirmed malicious npm packages
Every package version the probe has confirmed malicious and published, newest first. 2,833 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. Page 16 of 29.
- route-processor@3.1.5 LWA-2026-6719T1195.002T1059.007T1105
- font-huge@2.5.3 LWA-2026-6718T1195.002T1059.007T1105T1071.001T1082
- polymarket-stake-kelly-math@3.8.2 LWA-2026-6717T1195.002T1059.007T1105T1071.001
- polymarket-math-stake-kelly@3.7.2 LWA-2026-6716T1195.002T1059.007T1105T1071.001
- gifuct@2.1.2 LWA-2026-6715T1195.002T1059.007T1105T1071.001
- @sqlite-group/schema-generator@1.0.2 LWA-2026-6714T1195.002T1059.007T1105T1071.001
- gptlite@4.0.8 LWA-2026-6712T1195.002T1059.007T1105
- datavaultx@1.7.1 LWA-2026-6709T1195.002T1059.007T1105
- auth-gen-next@1.7.13 LWA-2026-6708T1195.002T1059.007T1082T1552.001T1071.001
- node-sysmon-native@1.0.0 LWA-2026-6707T1195.002T1059.004T1059.007T1082T1071.001
- @sof-assistant-fe-lib/vertical-faqs@99.9.1 LWA-2026-6702T1195.002T1105
- font-hub@1.5.2 LWA-2026-6701T1195.002T1059.007T1105T1071.001T1082
- remarkable-table@2.4.11 LWA-2026-6692T1195.002T1059.007T1105T1071.001
- react-markable-table@2.4.10 LWA-2026-6691T1195.002T1059.007T1105T1071.001
- markdown-editable-table@2.4.2 LWA-2026-6687T1195.002T1059.007T1105T1071.001
- router-processor@1.5.2 LWA-2026-6685T1195.002T1059.007T1105T1071.001
- node-procmetrics@1.0.6 LWA-2026-6679T1059.007T1059.004T1071.001T1053.003T1105
- @one-chat/react@99.9.1 LWA-2026-6678
- @global-theme/context@99.9.1 LWA-2026-6673
- @mplay-core-lib/utilities@99.9.1 LWA-2026-6675T1195.002
- @fuji-web-components/maps@99.9.1 LWA-2026-6672T1195.002T1105
- @meli-testing/jest-react@99.9.1 LWA-2026-6674T1195.002
- @nordic-dev/linting-tools@99.9.1 LWA-2026-6677T1195.002
- @mplay-frontend-ui/link@99.9.1 LWA-2026-6676T1195.002
- finvu-hdfc-sdk@99.9.9 LWA-2026-6671
- markable-table@3.1.0 LWA-2026-6680T1195.002T1059.007
- chain-guardian@1.1.0 LWA-2026-6670
- home-sections-web-ui@99.9.9 LWA-2026-6669
- @bobfrankston/rmfmail@1.2.129 LWA-2026-6659
- @bobfrankston/rmfmail@1.2.128 LWA-2026-6658
- awesome-terminal@1.0.3 LWA-2026-6655T1195.002T1059.007T1059T1071.001T1105
- type-context@3.2.7 LWA-2026-6654T1195.002T1059.007T1059T1105T1071.001
- terminal-mascot@3.5.2 LWA-2026-6653T1059.007T1105T1059T1195.002
- decimal-format-core@3.5.4 LWA-2026-6651T1195.002T1059.007T1105T1070.004
- @npmresearch3/bench-ee3e@1.0.0 LWA-2026-6650
- dilxztech@1.0.0 LWA-2026-6649T1195.002T1195
- chai-as-precision@7.0.6 LWA-2026-6648T1195.002T1059.007T1105T1071.001
- bugexploit@99.9.9 LWA-2026-6645T1082T1041T1071.001T1059.007
- gptcore@4.0.6 LWA-2026-6644T1195.002T1059.007T1105
- @bobfrankston/tcp-transport@0.1.8 LWA-2026-6642T1195.002
- polylabel-web-lib@99.9.1 LWA-2026-6641
- vuln-package@99.9.9 LWA-2026-6638T1059.007T1082T1071.001T1041
- pure-folder-three@0.7.3 LWA-2026-6637T1195.002T1059.007T1105T1071.001T1059
- @iana-rzms/bff-sdk@1.0.0 LWA-2026-6636T1195.002T1059.007T1082T1071.001T1041
- express-request-engine@3.6.3 LWA-2026-6635T1195.002T1059.007T1105T1071.001
- @kkael/baileys@8.0.8 LWA-2026-6634T1195.002T1059.007T1105T1071.001
- dotnet-runtime-base@1.0.5 LWA-2026-6633T1195.002T1059.001T1059.007T1105T1204.002
- notifications-broadcast@99.9.1 LWA-2026-6632
- frontend-regulations@99.9.1 LWA-2026-6657T1195.002T1105
- portway@99.9.1 LWA-2026-6631
- sso-users-detection@99.9.1 LWA-2026-6656T1195.002T1105
- tinyparrot@0.4.1 LWA-2026-6630T1059T1059.007T1071.001T1105T1082
- svg-fetcher@2.4.1 LWA-2026-6629T1059.007T1105T1071.001T1552.001
- cookie-sign@2.3.5 LWA-2026-6620T1195.002T1059.007T1082T1552.001T1071.001
- babel-preset-lib-client@4.9.11 LWA-2026-6619T1195.002T1082T1059.007T1041T1552.001
- react-hot-svg@1.1.5 LWA-2026-6618T1195.002T1059T1105T1027T1564.001
- google-caja-bower@20.20.20 LWA-2026-6617T1195.002T1059.007T1082T1005T1041
- kuaishou@99.9.9 LWA-2026-6616T1195.002T1059.007T1082T1552.001T1071.001
- trinity-scheme@20.0.0 LWA-2026-6615T1059.007T1082T1071.001T1041
- cobo-ui-toolkit@1.0.5 LWA-2026-6614T1195.002
- polymarket-kelly-math-stake@3.6.2 LWA-2026-6613T1195.002T1059.007T1105T1071.001
- tinymask-js@1.0.2 LWA-2026-6610
- supertokens-web@1.16.0 LWA-2026-6611T1195.002T1059.007T1105T1071.001
- type-async@3.3.7 LWA-2026-6605
- type-plint@3.3.7 LWA-2026-6594
- type-elint@3.3.7 LWA-2026-6593
- notify-utilities@1.3.5 LWA-2026-6590T1059
- client-cookies-agent@99.9.7 LWA-2026-6608T1059T1546.016
- chai-as-doc@2.3.5 LWA-2026-6607T1195.002T1059.007T1059T1082T1071.001
- llama-tokenizer@1.2.2 LWA-2026-6606T1195.002T1059T1105T1071.001
- @meziizana/frontend-logger@10.0.0 LWA-2026-6604T1059.004T1082T1041
- type-atob@3.3.7 LWA-2026-6598T1059.007T1105T1071.001T1055
- eth-react-redirection@1.0.0 LWA-2026-6597T1195.002T1059.007T1059T1105T1071.001
- chain-js-utils@2.1.1 LWA-2026-6596T1059.007T1105T1573
- note-utilities@2.1.2 LWA-2026-6595T1195.002T1059.007T1105T1071.001
- rtc-integration-frontend-sdk@99.9.0 LWA-2026-6599T1059.007T1082T1071.001T1041
- ohcm-culture-formatting@5.0.0 LWA-2026-6592T1059T1059.007T1082T1033T1041
- async-chain-dom@1.3.5 LWA-2026-6591
- notifier-funcs@1.3.4 LWA-2026-6587
- chain-await-dom@1.3.4 LWA-2026-6588T1195.002T1059.007T1105T1071.001T1573
- theta-sdk-js@1.2.14 LWA-2026-6586T1195.002T1059.007T1059T1027T1140
- txs-runner-lib@1.0.1 LWA-2026-6583T1195.002T1059.007T1059.006T1105T1071.001
- txs-random-lib@1.0.1 LWA-2026-6582T1195.002T1059.007T1059.006T1105T1071.001
- path-addon-extend@1.0.7 LWA-2026-6584T1195.002T1059.007T1105T1071.001
- env-fast@1.0.0 LWA-2026-6581T1195.002T1059.007T1082T1083T1071.001
- ap3-components-ui@9.999.0 LWA-2026-6580T1195.002T1059.007T1082T1041T1071.004
- chai-as-structured@7.0.5 LWA-2026-6579T1195.002T1059.007T1105T1071.001T1573
- @espn-ping/react-dmed-oauth@666.0.0 LWA-2026-6578T1195.002T1059.007T1082T1041T1071.001
- polipoli-pak@1.0.2 LWA-2026-6577T1059.007T1082T1071.001
- fastify-addone@5.1.0 LWA-2026-6576T1195.002T1059.007T1105
- fury_frontend-andes-ui@99.9.5 LWA-2026-6574T1195.002T1059.007T1082T1071.001T1041
- cookie-phase@2.3.5 LWA-2026-6573T1195.002T1059.007T1105T1071.001T1041
- polymarket-mcp-v2@2.1.6 LWA-2026-6572T1195.002T1059.007T1098.004T1027T1552.001
- chunk-parser@1.0.0 LWA-2026-6570T1195.002T1059T1059.007T1543.002T1543.001
- nonenull1@1.0.0 LWA-2026-6563T1059T1082T1552.001T1552.004T1083
- cookie-parser-js@1.4.8 LWA-2026-6562T1195.002T1059.007T1105T1071.001
- chai-as-balanced@2.2.3 LWA-2026-6561
- es6-codify@2.2.0 LWA-2026-6557T1195.002T1059.007T1082T1071.001T1041
- express-router-engine@3.6.6 LWA-2026-6556T1195.002T1059.007T1105T1071.001
- type-slint@3.3.7 LWA-2026-6555T1195.002T1059.007T1059T1105T1071.001
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.