Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 16 of 37.
- @onereach/orest-vue-demi-vue2@0.0.6 LWA-2026-7969T1059.007T1105
- @onereach/si-alert@0.4.13 LWA-2026-7961T1059.007T1105T1027
- @onereach/pnpm-audit-junit@1.0.5 LWA-2026-7965T1059.007T1105T1027
- @onereach/si-checkbox@0.6.7 LWA-2026-7963T1059.007T1027T1105
- @onereach/idw-apps@0.1.5 LWA-2026-7962T1059.007T1027
- @onereach/condition-builder@1.0.10 LWA-2026-7964T1059.007T1105
- @onereach/si-list@0.7.6 LWA-2026-7960T1059.007T1105T1082T1027
- @onereach/si-step-chooser@0.4.6 LWA-2026-7959T1059.007T1105T1027
- @onereach/si-datepicker@0.4.7 LWA-2026-7958T1059.007T1105T1071.001T1082T1059
- @onereach/regex-helper@0.5.18 LWA-2026-7952T1059.007T1105
- @onereach/si-dropdown-simple@0.4.7 LWA-2026-7950T1059.007T1105T1027
- @onereach/si-copyable-text@0.4.13 LWA-2026-7951T1059.007T1105T1082
- @onereach/si-code@0.6.6 LWA-2026-7947
- @onereach/si-textinput@0.5.7 LWA-2026-7949T1059.007T1105
- @onereach/si-divider@0.4.13 LWA-2026-7948T1059.007T1105T1027
- @onereach/si-switch@0.4.7 LWA-2026-7946T1059.007T1105
- @onereach/si-a-button@0.0.5 LWA-2026-7945T1059.007T1105T1027
- @onereach/si-checkbox-group@0.3.7 LWA-2026-7944T1059.007T1105
- @onereach/channel-transformer@0.0.68 LWA-2026-7943T1059.007T1105
- @onereach/channel-transformers@0.0.7 LWA-2026-7939T1059.007T1105T1027
- @onereach/content-builder-template-compiler@0.0.5 LWA-2026-7941T1059.007T1105
- @onereach/bandwidth-steps-voice-bxml@0.1.3 LWA-2026-7942T1059.007T1105T1027
- @onereach/si-dropdown-advanced@0.4.7 LWA-2026-7907T1059.007T1105T1027
- @onereach/si-collapsible-group@0.6.6 LWA-2026-7902T1059.007T1105T1027
- @onereach/si-radio-group@0.3.7 LWA-2026-7904T1059.007T1027
- @onereach/si-text-message@0.4.7 LWA-2026-7905T1195.002T1059.007T1027T1105
- @onereach/si-select@0.1.5 LWA-2026-7901T1059.007T1105
- @onereach/si-validated-timestring-input@0.3.7 LWA-2026-7903T1059.007T1105
- umadev@1.0.74 LWA-2026-7977T1059.007T1105
- @onereach/orest-jest-presets@0.0.5 LWA-2026-7896T1059.007T1027T1105
- ach-detail@99.0.1 LWA-2026-7895T1195.002T1059.007T1082T1071.001
- @onereach/step-components@0.1.39 LWA-2026-7900T1059.007T1105T1027
- @onereach/regular-expressions-test@0.0.6 LWA-2026-7898T1059.007T1105
- @thiennq/docs-viewer@1.6.3 LWA-2026-7897T1059.007T1027T1105
- @onereach/idw-contracts@0.1.4 LWA-2026-7899T1059.007T1105T1027
- @onereach/time-interpreter@1.0.32 LWA-2026-7871T1195.002T1059.007T1027T1105
- verdaccio-okta-oauth@38.1.12 LWA-2026-7757T1195.002T1059.007T1105
- @servicetitan/carto-react-kit@0.8.8 LWA-2026-7758T1195.002T1059.007T1105
- verdaccio-tarball-local-storage@38.1.12 LWA-2026-7756T1195.002T1059.007T1105T1027
- @servicetitan/json-render-react@0.4.10 LWA-2026-7755T1195.002T1059.007T1105
- @servicetitan/marketing-direct-mail-components@20.1.5 LWA-2026-7754T1195.002T1059.007T1105T1027
- folder-lint@1.0.17 LWA-2026-7753T1195.002T1059.007T1105T1027
- editable-contracts@0.0.23 LWA-2026-7752T1195.002T1059.007T1027T1105
- @servicetitan/anvil2-mcp@0.0.13 LWA-2026-7751T1195.002T1059.007
- @servicetitan/anvil2-ext-charts@0.2.8 LWA-2026-7750T1195.002T1059.007T1027T1105
- @servicetitan/carto-rn-kit@0.0.14 LWA-2026-7748T1195.002T1059.007T1105
- @servicetitan/mfe-quick-actions@0.5.53 LWA-2026-7749T1195.002T1059.007T1027.002T1105
- @servicetitan/titan-chatbot-ui-cypress@9.0.5 LWA-2026-7739T1195.002T1059.007T1105T1027
- @servicetitan/carto-charts-react@0.0.6 LWA-2026-7737T1195.002T1059.007T1027
- @servicetitan/titan-chat-ui-anvil2@9.0.5 LWA-2026-7738T1059.007T1105T1027T1195.002
- @servicetitan/eh-module-communication@0.2.5 LWA-2026-7735T1195.002T1059.007T1105T1027
- @servicetitan/carto-charts-rn@0.0.6 LWA-2026-7734T1195.002T1059.007T1105T1027
- @servicetitan/anvil-react@0.11.7 LWA-2026-7733T1195.002T1059.007T1059T1105T1027
- @servicetitan/examples@1.2.8 LWA-2026-7736
- @servicetitan/marketing-integration-widgets@1.0.44 LWA-2026-7730T1195.002T1059.007T1105T1027
- @servicetitan/contentful@0.0.7 LWA-2026-7731T1195.002T1059.007T1027T1105
- @servicetitan/anvil2-ext-mwv@0.0.9 LWA-2026-7732T1059.007T1195.002T1027.010
- @servicetitan/examples@1.2.9 LWA-2026-7728T1059.007T1195.002T1027T1105
- @servicetitan/forge@0.5.5 LWA-2026-7729T1195.002T1059.007T1105T1027
- @servicetitan/micro-frontend@0.0.8 LWA-2026-7724T1195.002T1059.007T1105T1027
- @servicetitan/mfe-quick-actions@0.5.52 LWA-2026-7727T1195.002T1059.007T1105T1027T1071
- @servicetitan/titan-chatbot-client@2.1.7 LWA-2026-7726T1195.002T1059.007T1105T1027T1071
- @servicetitan/titan-chatbot-ui-anvil2@9.0.5 LWA-2026-7725T1195.002T1059.007T1105T1027
- @servicetitan/titan-chat-ui@7.1.7 LWA-2026-7722T1195.002T1059.007T1105T1027
- @servicetitan/titan-chatbot-ui@7.1.7 LWA-2026-7721T1195.002T1059.007T1105T1027
- @servicetitan/microfront@0.0.6 LWA-2026-7723T1195.002T1059.007T1105T1027
- @ornikar/prismic-components@0.0.8 LWA-2026-7720T1195.002T1059.007T1105T1027
- @ornikar/rollup-plugin-postcss@2.0.10 LWA-2026-7719T1195.002T1059.007T1027.002T1105
- @ornikar/react-native-svg-transformer@1.0.10 LWA-2026-7718T1195.002T1059.007T1105
- @ornikar/browserslist-config@8.0.8 LWA-2026-7717T1195.002T1059.007T1105T1027
- @ornikar/postcss-config@9.1.7 LWA-2026-7716T1195.002T1059.007T1105T1027
- @ornikar/jest-config-react-native-web@12.0.8 LWA-2026-7715T1195.002T1059.007T1105
- @ornikar/lerna-config@11.0.6 LWA-2026-7714T1195.002T1059.007T1105T1027
- @ornikar/renovate-config@9.0.8 LWA-2026-7707T1195.002T1059.007T1105T1204.002
- @ornikar/react-modern-calendar-datepicker@3.2.6 LWA-2026-7706T1195.002T1059.007T1105T1027
- @ornikar/typed-css-modules-loader@0.8.7 LWA-2026-7705T1195.002T1059.007T1105
- @ornikar/babel-preset-react@6.1.6 LWA-2026-7703T1195.002T1059.007T1105T1027
- @ornikar/eslint-config-node@12.2.2 LWA-2026-7704T1195.002T1059.007T1105
- @ornikar/apollo-link-timeout@1.4.3 LWA-2026-7702T1195.002T1059.007T1105T1027
- @ornikar/eslint-config-babel-use@13.2.4 LWA-2026-7699T1195.002T1059.007T1027.002T1105
- @onereach/ts-memoize@1.0.2 LWA-2026-7698T1195.002T1059.007T1027T1105
- @ornikar/eslint-config-typescript-nestjs@24.0.1 LWA-2026-7697T1195.002T1059.007T1105T1027T1059
- @ornikar/eslint-config-typescript-react@24.0.1 LWA-2026-7696T1195.002T1059.007T1059T1027T1105
- tailwind-anime@1.1.0 LWA-2026-7695
- internallib_v524@1.0.2 LWA-2026-7694T1195.002T1059.007T1059.004T1105T1071.001
- bigops-call-history@35.8.9 LWA-2026-7691T1195.002T1059.007T1105T1071.001T1204.002
- bigops-auth-interceptor@35.7.2 LWA-2026-7689T1195.002T1059.007T1105T1071.001T1573
- bigops-chats@35.9.6 LWA-2026-7690T1195.002T1059.007T1105T1071.001T1572
- bigops-create-manifest@35.2.4 LWA-2026-7688T1059.007T1105T1071.001T1027T1564.001
- bigops-eslint-config@35.1.9 LWA-2026-7687T1195.002T1059.007T1105T1071.001T1568.002
- bigops-header-tabs@35.8.2 LWA-2026-7686T1195.002T1059.007T1082T1105T1071.001
- bigops-customer@35.1.1 LWA-2026-7684T1059.007T1105T1071.004T1082T1204.002
- bigops-auth-provider-interceptor@35.8.3 LWA-2026-7682T1195.002T1059.007T1105T1071.001T1573
- bigops-chats-client@35.2.4 LWA-2026-7683T1195.002T1059.007T1105T1071.001T1204.002
- bigops-external-auth@35.1.6 LWA-2026-7685T1195.002T1059.007T1105T1071.001T1573
- bigops-info-notices@35.9.8 LWA-2026-7681T1195.002T1059.007T1105T1071.001T1573
- bigops-chat-files-hub-client@35.4.6 LWA-2026-7680T1195.002T1059.007T1105T1071.001T1573
- bigops-chat-tmsg@35.8.5 LWA-2026-7678T1195.002T1059.007T1105T1071.001T1573
- bigops-data-storage@35.7.1 LWA-2026-7677T1195.002T1059.007T1105T1071.001T1573
- bigops-cobrowsing-client@35.1.9 LWA-2026-7679T1059.007T1105T1071.001T1027T1082
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.