Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 17 of 37.
- bigops-auth@35.8.6 LWA-2026-7675T1195.002T1059.007T1105T1071.001T1573
- bigops-file-storage@35.1.2 LWA-2026-7674T1195.002T1059.007T1105T1071.001T1573
- bigops-awesome-viewer@35.1.4 LWA-2026-7676T1195.002T1059T1105T1071.001T1568.002
- bigops-eslint@35.9.5 LWA-2026-7693T1195.002T1059T1105T1071.001T1573
- bigops-backend@35.8.3 LWA-2026-7672T1195.002T1059.007T1105T1071.001T1573
- bigops-chat-transfer@35.3.6 LWA-2026-7670T1059.007T1105T1071.004T1204.002T1027
- bigops-frontend-bigops-frontend-core@35.1.5 LWA-2026-7671T1195.002T1059.007T1105T1071.001T1573
- bigops-auth-cache@35.3.9 LWA-2026-7692T1195.002T1059.007T1105T1071.001T1572
- bigops-communication-client@35.8.8 LWA-2026-7673T1195.002T1059.007T1105T1071.001T1204.002
- bigops-informer@35.4.8 LWA-2026-7669T1195.002T1059.007T1027T1082T1105
- bigops-figma-to-html@35.5.5 LWA-2026-7667T1195.002T1059.007T1105T1071.001T1082
- bigops-auth-utils@35.4.5 LWA-2026-7668T1195.002T1059.007T1105T1071.001T1573
- bigops-cobrowsing@35.4.9 LWA-2026-7666T1195.002T1059.007T1564.001T1071.001T1572
- bigops-customer-processing-client@35.1.8 LWA-2026-7665T1195.002T1059.007T1105T1071.001T1573
- bigops-api-mobile@35.6.2 LWA-2026-7664T1195.002T1059.007T1105T1071.001T1573
- stellarfixer@1.0.0 LWA-2026-7663T1195.002T1059.007T1059.001T1547.001T1053.005
- simple-date-formatter-new-8@1.0.0 LWA-2026-7662T1195.002T1059.004T1082T1046T1071.001
- simple-date-formatter-new-7@1.0.0 LWA-2026-7661T1195.002T1059.004T1059.007T1082T1615
- simple-date-formatter-new-6@1.0.0 LWA-2026-7660T1195.002T1059.004T1059.007T1082T1615
- simple-date-formatter-new-5@1.0.0 LWA-2026-7659T1195.002T1059.004T1082T1046T1613
- simple-date-formatter-new-4@1.0.0 LWA-2026-7658T1195.002T1059.007T1082T1552.001T1005
- simple-date-formatter-new-3@1.0.0 LWA-2026-7657T1195.002T1059.004T1059.007T1082T1610
- simple-date-formatter-new-2@1.0.0 LWA-2026-7656T1195.002T1059.007T1082T1613T1071.001
- simple-date-formatter-new-1@1.0.0 LWA-2026-7655T1195.002T1059.004T1059.007T1082T1613
- simple-date-formatter-util-16@1.0.0 LWA-2026-7654T1195.002T1059.007T1059.004T1082T1552.001
- simple-date-formatter-util-15@1.0.0 LWA-2026-7653T1195.002T1059.004T1059.007T1610T1082
- simple-date-formatter-util-14@1.0.0 LWA-2026-7652T1195.002T1059.007T1082T1083T1614
- simple-date-formatter-util-13@1.0.0 LWA-2026-7651T1195.002T1059.007T1082T1083T1613
- vinci-spin@1.0.1 LWA-2026-7647T1195.002
- wildsinos@1.0.1 LWA-2026-7648T1195.002
- simple-date-formatter-util-11@1.0.0 LWA-2026-7646T1195.002T1059.004T1082T1613T1552.001
- simple-date-formatter-util-12@1.0.0 LWA-2026-7645T1195.002T1059.004T1082T1613T1552.001
- simple-date-formatter-util-10@1.0.0 LWA-2026-7644T1195.002T1059.007T1059.004T1082T1552.004
- shuffle-casinos@1.0.0 LWA-2026-7643T1195.002
- robocatenligne@1.0.1 LWA-2026-7641T1195.002
- rizzcasinofrance@1.0.0 LWA-2026-7640T1195.002
- internallib_v568@1.0.1 LWA-2026-7638T1059.004T1071.001
- kinbetfrcasino@1.0.0 LWA-2026-7636T1195.002
- juliusavis@1.0.0 LWA-2026-7635T1195.002
- leon-casino@1.0.1 LWA-2026-7637T1195.002
- simple-date-formatter-util-9@1.0.0 LWA-2026-7634T1195.002T1059.004T1059.007T1082T1552.004
- simple-date-formatter-util-8@1.0.0 LWA-2026-7632T1195.002T1059.007T1082T1005T1071.001
- entropyeasybots@2.0.2 LWA-2026-7631T1059.007T1059T1543.002T1027T1480
- simple-date-formatter-util-7@1.0.0 LWA-2026-7629T1195.002T1059.004T1059.007T1082T1005
- europe-fortunecasinofr@1.0.0 LWA-2026-7630T1195.002
- golden-panda-casino@1.0.1 LWA-2026-7628T1195.002
- simple-date-formatter-util-6@1.0.0 LWA-2026-7627T1195.002T1059.004T1059.007T1082T1552.004
- terminal-kit-tslint-config@20.1.9 LWA-2026-7626T1195.002T1059.007T1059T1105T1071.001
- staycasinos@1.0.0 LWA-2026-7625T1195.002
- sevencasinos@1.0.0 LWA-2026-7623T1195.002
- sportuna@1.0.0 LWA-2026-7624T1195.002
- simple-date-formatter-util-5@1.0.0 LWA-2026-7622T1195.002T1059.004T1082T1525T1552.001
- simple-date-formatter-util-4@1.0.0 LWA-2026-7621T1195.002T1059.004T1059.007T1082T1552.001
- sw-pluginer@1.1.0 LWA-2026-7620T1140T1027
- a.poltoradnev-package-b@33.9.1 LWA-2026-7612T1195.002T1059.007T1105T1071.001T1572
- accounts-limits@0.0.2 LWA-2026-7613T1195.002T1059.007T1105T1071.001T1082
- accounts-ddos-shield@33.3.8 LWA-2026-7611T1195.002T1059.007T1105T1071.001T1573
- remote_session_elements@9999.0.0 LWA-2026-7610T1195.002T1059.007T1082T1071.001T1041
- dc-renewals-layout2@9999.0.0 LWA-2026-7608T1195.002T1059.007T1082T1071.001T1041
- store-locator-widget@9999.0.0 LWA-2026-7609T1195.002T1059.007T1082T1041
- sc-geeksquad-core@9999.0.0 LWA-2026-7607T1195.002T1059.007T1082T1071.001T1041
- sc-payment-utils@9999.0.0 LWA-2026-7605T1195.002T1059.007T1082T1071.001T1041
- jquery.ui.core@9999.0.0 LWA-2026-7606T1195.002T1059.007T1082T1071.001T1041
- jquery.ui.tabs@9999.0.0 LWA-2026-7604T1195.002T1059.007T1082T1071.001T1041
- sc-font-icons@9999.0.0 LWA-2026-7603T1195.002T1059.007T1082T1071.001T1041
- break-after@9999.0.0 LWA-2026-7600T1195.002T1059.007T1082T1071.001T1041
- dust-helpers@9999.0.0 LWA-2026-7602T1195.002T1059.007T1082T1071.001T1041
- widget-forge@9999.0.0 LWA-2026-7598T1195.002T1059.007T1082T1071.001T1041
- editor_application@9999.0.0 LWA-2026-7599T1195.002T1059.007T1082T1071.001T1041
- application_base@9999.0.0 LWA-2026-7601T1195.002T1059.007T1082T1071.001T1041
- appsignal@9999.0.0 LWA-2026-7597T1195.002T1059.007T1082T1071.001T1041
- speaker_tagging_media_player@9999.0.0 LWA-2026-7596T1195.002T1059.007T1082T1071.001T1041
- accounts-appointment@33.2.6 LWA-2026-7595T1195.002T1059.007T1105T1071.001T1573
- beaver-ui-breadcrumbs@0.0.2 LWA-2026-7594T1195.002T1059.007T1105T1071.001T1573
- accounts-forms@0.0.2 LWA-2026-7593T1195.002T1059.007T1105T1071.001T1573
- accounts-card-design-picker@0.0.2 LWA-2026-7591T1195.002T1059.007T1105T1071.001T1573
- accounts-constants@0.0.2 LWA-2026-7592T1195.002T1059.007T1105T1071.001T1573
- aasp-tent-aasp-tent-core@0.0.2 LWA-2026-7590T1195.002T1059.007T1204.002T1082T1105
- tinkoff-pfpa-tools@20.3.1 LWA-2026-7587T1195.002T1059.007T1105T1071.001T1573
- statist-statist-core@20.9.9 LWA-2026-7588T1195.002T1059.007T1082T1105T1071.001
- tinkoff-boxy-desktop-features-banner@20.2.4 LWA-2026-7586T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1059T1082T1105
- tinkoff-component-infopanel@20.8.3 LWA-2026-7584T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1059T1082T1071.001
- T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- twork-data-services-product-design-data@20.1.5 LWA-2026-7580T1195.002T1059.007T1105T1071.001T1573
- tinkoff-pfp-integration-mobile-slider-icons@20.2.2 LWA-2026-7579T1195.002T1059.007T1082T1071.001T1105
- sso-tramvai-module-context-auth@20.4.5 LWA-2026-7578T1195.002T1059.007T1105T1071.001T1573
- platform-ui-island@20.5.9 LWA-2026-7577T1195.002T1059.007T1105T1071.001T1573
- invest-module-cookie@20.8.2 LWA-2026-7576T1195.002T1059.007T1059T1027T1036
- checkout-mobile-pay-button@20.8.3 LWA-2026-7575T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1059T1082T1071.001
- tcb-web-images@20.5.3 LWA-2026-7573T1195.002T1059.007T1105T1071.001T1573
- tinkoff-boxy-independent-kasko-form@20.1.3 LWA-2026-7571T1195.002T1059.007T1105T1071.001T1573
- pfp-forms-independent-sme-glossary-anchor@20.4.4 LWA-2026-7572T1195.002T1059.007T1204.002T1082T1105
- peter-desktop-peter-big-column@20.3.2 LWA-2026-7570T1195.002T1059.007T1082T1071.001T1105
- T1195.002T1059.007T1105T1071.001T1573
- twork-data-services-getting-arrests@20.1.1 LWA-2026-7568T1195.002T1059.007T1105T1071.001T1573
- tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events@20.9.9 LWA-2026-7567T1195.002T1059.007T1105T1071.001T1573
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.