Confirmed malicious npm packages
Every package version the probe has confirmed malicious and published, newest first. 2,833 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. Page 18 of 29.
- paperclip-adapter-helpers@1.0.6 LWA-2026-6364
- paperclip-adapter-helpers@1.0.7 LWA-2026-6363
- paperclip-adapter-helpers@1.0.8 LWA-2026-6362
- events-alias@15.0.1 LWA-2026-6361T1195.002T1059.007T1082T1071.001T1041
- zluri-ad-connector@9.9.9 LWA-2026-6360T1195.002T1059.007T1082T1552.001T1071.001
- airkey-mfa-react@20.0.1 LWA-2026-6359T1195.002T1059.007T1082T1041T1071.001
- chai-as-sharpened@7.0.9 LWA-2026-6358
- viteplugiin@1.0.28 LWA-2026-6357T1195.002T1059.007T1027
- express-guardian@1.4.1 LWA-2026-6354T1195.002T1059.007T1059T1071.001T1105
- validator-string@13.15.36 LWA-2026-6353T1195.002T1059.007
- chai-secure@1.2.3 LWA-2026-6352T1195.002T1059.007T1105T1071.001
- nodepack-daemon@1.2.9 LWA-2026-6351T1059.007T1105T1071.001T1195.002
- notify-funcs@1.3.5 LWA-2026-6350
- next-locomotive-init@1.0.0 LWA-2026-6347T1195.002T1059.007T1082T1071.001T1041
- @digiptf/common@99.99.99 LWA-2026-6346T1195.002T1059.004T1082T1071.001T1041
- pinokio-redis@1.0.127 LWA-2026-6345T1195.002T1059.007T1059T1543.002T1547.001
- chai-as-disarmed@3.2.3 LWA-2026-6344T1195.002T1059.007T1105T1071.001T1573
- @sqlite-list/schema-generator@1.0.2 LWA-2026-6343
- @sqlite-list/createsql@1.0.0 LWA-2026-6342
- chai-sdk@1.4.8 LWA-2026-6339
- chai-sdk@1.4.7 LWA-2026-6338T1140T1027
- ai-gen-ai-opt-in@99.0.0 LWA-2026-6336T1016.001
- gen-ai-opt-in@99.0.1 LWA-2026-6337
- zredis-typed@1.0.127 LWA-2026-6335T1195.002T1059.007T1053T1543.003T1564.001
- @bobfrankston/gcal@0.1.68 LWA-2026-6330T1195.002T1059.007T1552.001T1041
- agn-terminal@0.1.0 LWA-2026-6329T1059T1105T1071.001
- @adobesign/as-dev-tools@99.9.10 LWA-2026-6328T1195.002T1059.004T1082T1041
- zod-pino434@1.0.128 LWA-2026-6326T1059
- zod-pino434@1.0.127 LWA-2026-6323T1195.002T1059.007T1059T1543.002T1547.001
- internallib_v234@1.0.3 LWA-2026-6318T1059.007T1105T1071.001
- polytrade@2.4.1 LWA-2026-6317T1195.002T1059.007T1105T1071.001T1552.004
- paperclip2@1.0.0 LWA-2026-6316T1059.007T1071T1059
- vps-maintenance@0.1.0 LWA-2026-6315T1059.007T1071.001
- @bobfrankston/mailx-store-web@0.1.35 LWA-2026-6312T1195.002T1071.001T1552.001T1082
- @bobfrankston/mailx-imap@0.1.112 LWA-2026-6314T1195.002
- @bobfrankston/mailx-store@0.1.58 LWA-2026-6313T1195.002T1105
- chai-presentation@0.0.3 LWA-2026-6286T1195.002T1059.007T1105T1071.001
- chai-presentation@0.0.2 LWA-2026-6287T1195.002T1059.007T1105T1071.001
- chai-presentation@0.0.1 LWA-2026-6285T1195.002T1059.007T1105T1071.001
- chai-as-serialized@7.0.8 LWA-2026-6293T1195.002T1059.007T1105T1071.001
- debugcli@4.3.4 LWA-2026-6309T1195.002T1059.007T1082T1552.001T1555.003
- @bobfrankston/msger@0.1.388 LWA-2026-6307T1059.007T1204.002
- chai-redirection@0.0.1 LWA-2026-6302T1195.002T1059.007T1105T1071.001T1059
- @bobfrankston/brother-label@1.1.12 LWA-2026-6303T1195.002
- react-icons-svgo@1.5.4 LWA-2026-6299T1195.002T1059.007T1105T1204.002
- polymarket-trader-apis@0.1.0 LWA-2026-6297T1195.002T1059.007T1105T1071.001T1082
- mdb-vite@1.5.2 LWA-2026-6296T1195.002T1059.007T1105T1071.001
- react-v17@20.0.1 LWA-2026-6295T1195.002T1059.007T1082T1041T1071.001
- polymarket-apis@1.1.0 LWA-2026-6294T1195.002T1059.007T1105T1071.001T1082
- ne-logger@0.5.0 LWA-2026-6292T1195.002T1059.007T1082T1567.001
- neon-terminal@0.5.0 LWA-2026-6291T1195.002T1059.007T1082T1567
- yiyuan-api@1.0.3 LWA-2026-6290T1195.002T1059.007T1552.001T1071.001T1557
- vps-maintenance-paperclip-adapter@0.1.1 LWA-2026-6288T1059T1546.016
- giantswarm@22.0.1 LWA-2026-6284T1059.007T1082T1071.001T1041
- luludawang-kit@0.0.1 LWA-2026-6283T1027T1140
- chai-submision@0.5.4 LWA-2026-6282T1195.002
- evm-typechain@0.5.4 LWA-2026-6281T1195.002T1059.007T1105T1071.001
- @broadpeak/smartlib-ad@24.1.10 LWA-2026-6280T1195.002T1059.007T1082T1071.001T1041
- polygon-gamma-apis@1.5.2 LWA-2026-6279T1195.002T1059.007T1105T1573T1082
- polygon-gama-apis@1.4.1 LWA-2026-6278T1195.002T1059.007T1105T1071.001
- unreal-horde-dashboard@99999.0.0 LWA-2026-6277T1195.002T1059.007T1082T1552T1071.001
- ue-jenkins-buildkite@99999.0.0 LWA-2026-6276T1195.002T1059.007T1082T1552.001T1071.001
- epic-internal-tools@99999.0.0 LWA-2026-6275T1195.002T1059.007T1082T1552.001T1041
- robomerge@99999.0.0 LWA-2026-6274T1195.002T1059.007T1082T1552.001T1071.001
- notifier-utils@1.3.7 LWA-2026-6273T1195.002T1059.007T1105T1071.001T1055
- chai-chain-dom@1.3.7 LWA-2026-6272T1195.002T1059.007T1105
- jsf-utils@0.3.1 LWA-2026-6271
- jsf-utils@1.3.1 LWA-2026-6270T1620
- better-tailwindcss@4.6.3 LWA-2026-6269T1195.002T1105T1059.007
- transform-es2015-sticky-regex@6.24.3 LWA-2026-6268T1195.002T1192T1105
- express-ini@12.1.10 LWA-2026-6267T1195.002T1059.007T1059T1027T1564.003
- chai-await-dom@1.3.7 LWA-2026-6265T1195.002T1059.007T1105T1064
- webrix-docs1@10.2.11 LWA-2026-6263T1195T1059.007T1082T1041
- webrix-docs@19.2.11 LWA-2026-6262T1195.002T1059.007
- chai-as-align@7.1.0 LWA-2026-6261T1059.007T1105T1071.001T1195.002
- db-query-log@1.0.2 LWA-2026-6260T1195.002T1059.007T1027T1105
- marked-prettier@1.0.5 LWA-2026-6259T1195.002T1059.007T1105T1071.001
- execfences@5.0.2 LWA-2026-6258T1195.002T1059.007T1105T1071.001T1573
- compose-logger-stand@1.0.126 LWA-2026-6254T1195.002T1059.007T1059T1543T1547
- react-jsonwebtoken@9.0.5 LWA-2026-6253T1195.002T1059.007T1105T1071.001
- chain-chai-await@1.3.6 LWA-2026-6252
- npm-rce-poc@1.0.13 LWA-2026-6250T1059.007T1105T1059.004T1204.002
- datefmt-helper@1.0.0 LWA-2026-6249T1195.002T1059.007T1105T1059.004
- lusha-iam-widgets@1.5.2 LWA-2026-6248T1195.002T1195
- cursed-ecto-d3ab00@1.0.0 LWA-2026-6247T1059.007T1082T1552.001T1041T1046
- base65-85x@5.0.1 LWA-2026-6241T1195.002T1059.007T1071.001T1041
- mjs-eslint@7.0.7 LWA-2026-6240T1195.002T1059.007T1082T1552.001T1041
- crypto-base58@1.0.1 LWA-2026-6239T1195.002T1059.007T1547.001T1082T1115
- solana-address-codec@1.0.2 LWA-2026-6238T1195.002
- chalk-plus-ts@1.0.4 LWA-2026-6242T1195.002T1059.007T1105T1071.001T1573
- polymarket-trading-developer-tool@0.1.2 LWA-2026-6237T1195.002T1059.007T1105T1071.001
- eslint-jest@4.0.6 LWA-2026-6235T1195.002T1059.007T1105
- eslint-jest@4.0.5 LWA-2026-6236T1195.002T1059.007T1105
- @marketfront/fingerprint@7.0.0 LWA-2026-6234T1027
- @marketfront/changefilter@7.0.0 LWA-2026-6233
- api-changelly@19.2.11 LWA-2026-6232T1195.002T1059.007
- @marketfront/actualordersnippetpopup@7.0.0 LWA-2026-6231T1195.002T1059.007T1552.001T1041
- @marketfront/basemarkettemplate@7.0.0 LWA-2026-6229T1195.002T1059.007T1027T1082T1071.001
- @marketfront/bannerpopup@7.0.0 LWA-2026-6228T1059.007T1027T1140T1480T1082
- @marketfront/advertisingdevtool@7.0.0 LWA-2026-6227T1195.002T1059.007T1082T1071.001
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.