Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 18 of 37.
- tinkoff-pfp-block-mobile-panels@20.2.7 LWA-2026-7566T1195.002T1059.007T1105T1071.001T1573
- pfp-block-mobile-vacancy-description@20.4.1 LWA-2026-7565T1195.002T1059.007T1105T1071.001T1573
- tinkoff-statist-browser-typed-client-investaccounting.events.templatepage.mainpage@20.4.5 LWA-2026-7562T1195.002T1059.007T1105T1071.001T1573
- pfa-autotests-reporter@20.2.8 LWA-2026-7563T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1204.002
- tinkoff-component-page-loader@20.8.2 LWA-2026-7561T1195.002T1059.007T1105T1071.001T1573
- travel-core-utils-object@20.3.4 LWA-2026-7558T1195.002T1059.007T1059T1105T1071.001
- saas-f-testing@20.4.2 LWA-2026-7559T1195.002T1059.007T1105T1071.001T1573
- finance-business-company-id-models@20.1.5 LWA-2026-7560T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- tinkoff-boxy-mobile-documents@20.1.7 LWA-2026-7554T1195.002T1059.007T1059.003T1059.004T1105
- checkout-common-tokens@20.1.6 LWA-2026-7555T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- hubert-react-query@20.6.8 LWA-2026-7552T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1568.002
- deposits-overnight@20.8.5 LWA-2026-7549T1195.002T1059.007T1105T1071.001T1573
- checkout-create-pos-order-am@20.9.5 LWA-2026-7550T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- twork-data-services-aggregator-sme-task-info@20.3.1 LWA-2026-7544T1195.002T1059.007T1082T1071.001T1102
- tinkoff-ui-action@20.5.7 LWA-2026-7542T1195.002T1059.007T1059T1105T1071.001
- specials-obid-webpack@20.5.4 LWA-2026-7548T1195.002T1059.007T1105T1071.001T1573
- tinkoff-pfp-atom-styles-tiles@20.2.8 LWA-2026-7541T1195.002T1059.007T1082T1105T1071.001
- tinkoff-boxy-atom-text-link@20.5.9 LWA-2026-7547T1195.002T1059.007T1082T1071.001T1573
- tinkoff-fb-rf-add-application@20.3.5 LWA-2026-7546T1195.002T1059.007T1105T1071.001T1573
- sme-scripts-shared-library-webpack-plugin@20.2.9 LWA-2026-7543T1195.002T1059.007T1105T1071.001T1573
- tui-react-tooltip@20.5.4 LWA-2026-7540T1195.002T1059T1105T1071.001T1573
- fb-insurance--boxified-form-vzr-test@20.3.7 LWA-2026-7539T1195.002T1059.007T1105T1071.001T1071.004
- pfp-block-independent-iframe@20.4.9 LWA-2026-7538T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1059T1105T1071.001
- hubert-appointment-v2-task-create-am@20.4.4 LWA-2026-7536T1195.002T1059.007T1105T1071.001T1573
- eventea-router@20.2.3 LWA-2026-7534T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events@20.9.9 LWA-2026-7530T1195.002T1059.007T1105T1071.001T1573
- twork-data-services-role-app@20.9.6 LWA-2026-7531T1195.002T1059.007T1059T1082T1105
- twork-data-services-invest-box-account@20.8.8 LWA-2026-7529T1195.002T1059.007T1105T1071.001T1573
- statist-browser-typed-client-coretech.web.metrics@20.1.8 LWA-2026-7528T1195.002T1059.007T1082T1105T1071.001
- T1195.002T1059.007T1059.003T1059.004T1105
- shopping-shared-atom-mobile-cart-counter@20.6.6 LWA-2026-7526T1195.002T1059.007T1105T1071.001T1102
- T1195.002T1059.007T1105T1071.001T1573
- simple-date-formatter-util-2@1.0.0 LWA-2026-7524T1195.002T1059.007T1082T1083T1005
- simple-date-formatter-util-1@1.0.0 LWA-2026-7522T1195.002T1059.007T1082T1005T1041
- tailwind-anim@1.2.5 LWA-2026-7523T1195.002T1059.007T1082T1071.001T1573
- tinkoff-boxy-desktop-icons-horizontal@20.1.8 LWA-2026-7521T1195.002T1059.007T1105T1071.001T1573
- bnpl-blocks-independent-bnpl-search@20.2.9 LWA-2026-7516T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- dolyame-boxy-independent-bnpl-info-images@20.7.2 LWA-2026-7515T1195.002T1059.007T1105T1071.001T1573
- statist-browser-typed-client-mb.product.sme.cards@20.5.9 LWA-2026-7520T1195.002T1059.007T1105T1071.001T1573
- taiga-ui-proprietary-navigation@20.1.2 LWA-2026-7514T1195.002T1059.007T1105T1071.001T1573
- pvm-autodoc@20.4.6 LWA-2026-7513T1195.002T1059.007T1105T1071.001T1573
- pfa-errors@20.4.9 LWA-2026-7512T1195.002T1059.007T1105T1071.001T1573
- twork-data-services-counterfree@20.1.3 LWA-2026-7517T1195.002T1059.007T1082T1071.001T1105
- dolyame-boxy-independent-bnpl-open-api@20.8.9 LWA-2026-7518T1195.002T1059.007T1082T1105T1071.001
- scrollbar-hide-plugin@1.0.1 LWA-2026-7508T1195.002T1059.007T1071.001T1102T1105
- tailwindcss-anim@1.3.3 LWA-2026-7509T1059.007T1071.001T1573T1105T1082
- sme-auth-core@20.9.2 LWA-2026-7511T1195.002T1059.007T1082T1071.001T1573
- bigops-voximplant@20.8.5 LWA-2026-7510T1195.002T1059.007T1105T1071.001T1573
- tailwind-custom-forms@0.5.2 LWA-2026-7507T1027T1140
- twork-data-services-sme-operations-authorizations@20.8.9 LWA-2026-7506T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- tms-x-headers@20.2.9 LWA-2026-7504T1195.002T1059.007T1105T1071.001T1573
- tinkoff-mutual-mgm-form@20.2.9 LWA-2026-7503T1195.002T1059.007T1105T1071.001T1573
- tinkoff-codeceptjs-storyshots@20.7.8 LWA-2026-7502T1195.002T1059.007T1059T1082T1071.001
- tinkoff-codeceptjs-storyshots-alpha@20.8.9 LWA-2026-7498T1195.002T1059.007T1564.001T1071.001T1071.004
- tcb-web-copy-to-clipboard@20.1.2 LWA-2026-7500T1195.002T1059T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- trapp-configuration@20.5.3 LWA-2026-7499T1195.002T1059.007T1105T1071.001T1573
- time-linters-webapp-eslint-config@20.2.2 LWA-2026-7494T1195.002T1059.007T1082T1105T1071.001
- time-webkit-tag@20.1.6 LWA-2026-7493T1195.002T1059.007T1105T1071.001T1573
- tramvai-tinkoff-module-legacy-popup@20.4.9 LWA-2026-7495T1195.002T1059.007T1082T1105T1071.001
- T1195.002T1059.007T1105T1071.001T1573
- tinkoff-terminal-kit-test-commons@20.9.7 LWA-2026-7496T1195.002T1059.007T1105T1071.001T1573
- statist-browser-typed-client-ddp.mentat.ui.web@20.9.4 LWA-2026-7492T1195.002T1059.007T1105T1071.001T1573
- digital-interview-digital-interview-core@20.5.3 LWA-2026-7491T1195.002T1059.007T1105T1071.001T1573
- fb-hr-sites--boxified-form-meetup-subcribe@20.6.4 LWA-2026-7487T1195.002T1059.007T1105T1071.001T1573
- tinkoff-boxy-desktop-mgm-product-filter@20.1.8 LWA-2026-7489T1195.002T1059.007T1105T1071.001T1573
- tinkoff-boxy-mobile-vivid-heading@20.7.5 LWA-2026-7490T1195.002T1059.007T1105T1071.001T1573
- hubert-application-get-document-preview-am@20.4.6 LWA-2026-7488T1195.002T1059.007T1105T1071.001T1573
- scandoc-scandoc-core@20.8.5 LWA-2026-7484T1195.002T1059.007T1105T1071.001T1573
- hubert-verify-primary-email-am@20.4.6 LWA-2026-7485T1195.002T1059.007T1105T1071.001T1573
- nxify-unic@20.3.2 LWA-2026-7486T1195.002T1059.007T1105T1071.001T1573
- pfa-prettier-config@20.9.1 LWA-2026-7483T1195.002T1059.007T1105T1071.001T1573
- tinkoff-terminal-kit-datetime@20.7.2 LWA-2026-7482T1195.002T1059.007T1105T1071.001T1102
- T1195.002T1059.007T1105T1071.001T1573
- evo-web-base-analytics-data@20.1.5 LWA-2026-7480T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1059T1082T1071.001
- tinkoff-pwa-confac-types@20.7.7 LWA-2026-7477T1195.002T1059.007T1105T1071.001T1568
- pfp-block-mobile-past-meetup-list@20.5.1 LWA-2026-7475T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- travel-core-typings-reducers@20.7.8 LWA-2026-7474T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- pfp-forms-insurance-health@20.2.2 LWA-2026-7471T1195.002T1059.007T1059T1027T1082
- T1195.002T1059.007T1105T1071.001T1082
- fry-page-maker-types@20.6.4 LWA-2026-7472T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1082T1105T1071.001
- tinkoff-pfp-block-mobile-advert-footer@20.3.3 LWA-2026-7466T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- statist-browser-typed-client-social.shorts.editor@20.7.1 LWA-2026-7468T1195.002T1059.007T1105T1071.001T1573
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.