Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 19 of 37.
- pfp-forms-sme-sitebuilder@20.2.1 LWA-2026-7467T1195.002T1059.007T1059.003T1059.004T1082
- cardsmobile-collection@20.4.6 LWA-2026-7463T1195.002T1059.007T1105T1071.001T1573
- statist-browser-typed-client-sme.rko.tariffs.web@20.3.8 LWA-2026-7464T1195.002T1059.007T1105T1071.001T1573
- pfp-forms-mobile-sme-group-tiles@20.3.6 LWA-2026-7462T1195.002T1059.007T1105T1071.001T1573
- tinkoff-component-limits@20.4.9 LWA-2026-7459T1195.002T1059.007T1082T1105T1071.001
- pfp-block-mobile-steps@20.9.3 LWA-2026-7458T1195.002T1059.007T1105T1071.001T1568.002
- T1195.002T1059.007T1082T1105T1071.001
- react-scroll-disable@2.5.2 LWA-2026-7457T1195.002T1059.007T1105T1071.001T1573
- twork-data-services-sme-agent-company-relation@20.5.3 LWA-2026-7461T1195.002T1059.007T1105T1071.001T1573
- tinkoff-fb-fieldset-car-reference-kasko@20.7.7 LWA-2026-7452T1195.002T1059.007T1105T1071.001T1573
- sme-foundation-frame-manager@20.7.8 LWA-2026-7455T1195.002T1059.007T1105T1071.001T1573
- tinkoff-test-app-child-app@20.3.8 LWA-2026-7456T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- tinkoff-pfp-block-desktop-tabs@20.5.3 LWA-2026-7453T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events@20.1.8 LWA-2026-7448T1195.002T1059.007T1105T1071.001T1573
- trapp-check-logs@20.1.9 LWA-2026-7449T1195.002T1059.007T1105T1071.001T1573
- eventea-diag@20.5.3 LWA-2026-7450T1195.002T1059.007T1105T1071.001T1082
- tinkoff-volna-zustate@20.9.2 LWA-2026-7447T1195.002T1059.007T1105T1071.001T1573
- tinkoff-fb-app-frame-page-height-dippy@20.8.4 LWA-2026-7446T1195.002T1059.007T1105T1071.001T1568
- sso-tramvai-lib-roles@20.8.3 LWA-2026-7443T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1082
- boxy-fixture-allure@20.8.1 LWA-2026-7444T1195.002T1059.007T1105T1071.001T1573
- bpm-foundation-feature-flags@20.4.2 LWA-2026-7442T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1059T1027T1071.001
- tramvai-module-feature-toggle@20.5.3 LWA-2026-7440T1195.002T1059.007T1105T1071.001T1573
- tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events@20.2.5 LWA-2026-7439T1195.002T1059.007T1105T1071.001T1573
- saas-f-lego-landings@20.7.5 LWA-2026-7437T1195.002T1059.007T1105T1071.001T1573
- pfp-integration-mobile-heading@20.7.1 LWA-2026-7441T1195.002T1059.007T1105T1071.001T1573
- specials-mvno-client@20.9.8 LWA-2026-7436T1195.002T1059.007T1105T1071.001T1573
- vvvedernikov-test-another-test@20.2.6 LWA-2026-7435T1195.002T1059.007T1082T1105T1071.001
- bnpl-blocks-desktop-bnpl-documents@20.7.2 LWA-2026-7434T1195.002T1059.007T1105T1071.001T1573
- tailwind-animationgroup@2.3.7 LWA-2026-7432
- tailwind-animationpack@2.3.7 LWA-2026-7433
- pfp-forms-sme-loan@20.2.1 LWA-2026-7431T1195.002T1059.007T1059T1105T1071.001
- bigops-chat-messages@19.9.8 LWA-2026-7430T1195.002T1059.007T1082T1105T1071.001
- twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config@20.6.1 LWA-2026-7425T1195.002T1059.007T1082T1105T1059
- form-bnpl-dolyame-component-object@20.8.9 LWA-2026-7429T1195.002T1059.007T1059T1027T1105
- T1195.002T1059.007T1105T1071.001T1573.001
- prokit-core@20.6.6 LWA-2026-7428T1195.002T1059.007T1082T1105T1071.001
- lifestyle-test-utils@20.7.2 LWA-2026-7426T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1059.003T1059.004T1105
- tui-react-mobile-styles@20.8.7 LWA-2026-7423T1195.002T1059.007T1105T1071.001T1573
- tinkoff-fb-service-prefill-profile-contact@20.2.3 LWA-2026-7422T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- eacq-payform-core@20.3.6 LWA-2026-7420T1195.002T1059.007T1105T1071.001T1573
- dolyame-boxy-atom-bnpl-email-form@20.3.3 LWA-2026-7416T1195.002T1059.007T1105T1071.001T1573
- twork-mf-sandbox@20.9.7 LWA-2026-7419T1195.002T1059.007T1105T1071.001T1573
- statist-browser-typed-client-sme.rko.finance.web@20.7.7 LWA-2026-7415T1195.002T1059.007T1082T1071.001T1105
- fb-forms-form-boilerplate-contacts@20.7.1 LWA-2026-7418T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1059T1082T1071.001
- twork-products-taiga2-products-timeline@20.6.1 LWA-2026-7413T1195.002T1059.007T1082T1105T1071.001
- tinkoff-boxy-gitlab-labels@20.5.4 LWA-2026-7411T1195.002T1059.007T1105T1071.001T1573
- twork-mf-e2e-nitro@20.8.5 LWA-2026-7414T1195.002T1059.007T1105T1071.001T1573
- tinkoff-boxy-mobile-separator@20.8.8 LWA-2026-7412T1195.002T1059.007T1082T1071.001T1105
- tinkoff-boxy-form-desktop-sme-registration-ooo@20.4.5 LWA-2026-7410T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059T1105T1071.001T1573
- sme-crm-services-sme-crm-services-core@20.1.4 LWA-2026-7408T1195.002T1059.007T1105T1071.001T1573.001
- T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- sme-rko-finance-front-shared-entity-groups-models@20.2.8 LWA-2026-7399T1195.002T1059.007T1105T1071.001T1071.004
- hubert-document-actual-insurance-rules-am@20.5.6 LWA-2026-7407T1195.002T1059.007T1059.003T1059.004T1105
- tinkoff-cache-path@20.8.3 LWA-2026-7406T1195.002T1059T1105T1071.001T1573
- T1195.002T1059.007T1082T1105T1071.001
- T1195.002T1059.007T1105T1071.001T1573
- platform-ui-codemods@20.6.7 LWA-2026-7402T1195.002T1059.007T1105T1071.001T1573
- twork-products-taiga2-products-investment@20.2.8 LWA-2026-7404T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1573
- volna-boxy-di-test@20.3.8 LWA-2026-7395
- tcb-web-header@20.5.7 LWA-2026-7380
- sme-scripts-cli@20.5.3 LWA-2026-7394
- twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer@20.5.3 LWA-2026-7397T1195.002T1059.007T1059T1082T1071.001
- tinkoff-ui-angular-addon-wysiwyg@20.7.8 LWA-2026-7396T1195.002T1059.007T1082T1105T1071.001
- dolyame-ui-form@20.1.7 LWA-2026-7392T1195.002T1059.007T1105T1071.001T1573
- tinkoff-pfp-atom-desktop-carousel@20.8.8 LWA-2026-7393T1195.002T1059.007T1059T1027.013T1564.001
- fb-cards-form-no-resident-information@20.4.4 LWA-2026-7388T1195.002T1059.007T1027T1036T1071.001
- T1195.002T1059.007T1105T1071.001T1573
- dolyame-boxy-atom-bnpl-store-button@20.5.3 LWA-2026-7389T1195.002T1059.007T1105T1071.001T1573
- pfp-forms-sme-registration-ooo@20.2.1 LWA-2026-7390T1195.002T1059.007T1105T1071.001T1573
- T1195.002T1059.007T1105T1071.001T1082
- twork-products-taiga2-products-mobile@20.6.6 LWA-2026-7387
- twork-data-services-proxy-invest-symbols-list@20.4.6 LWA-2026-7381T1195.002T1059.007T1105T1071.001T1071.004
- statist-browser-typed-client-mb.product.payments@20.1.9 LWA-2026-7379T1195.002T1059.007T1105T1071.001T1573
- tinkoff-terminal-kit-carousel@20.6.3 LWA-2026-7383T1195.002T1059.007T1059.004T1105T1071.001
- statist-browser-typed-client-mb.product.analytics@20.1.2 LWA-2026-7378
- sotqa-test@20.3.8 LWA-2026-7377
- T1195.002T1059.007T1105T1071.001T1573
- tinkoff-boxy-desktop-two-panel-right-image@20.4.8 LWA-2026-7385T1195.002T1059.007T1105T1071.001T1568.002
- post-css-transfer@0.0.1 LWA-2026-7376
- @velliajs/telegram@1.0.0 LWA-2026-7375T1195.002T1552.001T1082T1105T1041
- approval-guardian@1.0.8 LWA-2026-7368T1059.007T1059.003T1059.001T1547.001T1053.005
- pp-react-worldready@1.0.0 LWA-2026-7354
- pp-react-worldready-v5@1.0.0 LWA-2026-7363
- @bobfrankston/rmfmail@1.2.208 LWA-2026-7364
- @bobfrankston/rmfmail@1.2.209 LWA-2026-7365
- @bobfrankston/rmfmail@1.2.210 LWA-2026-7366
- @bobfrankston/rmfmail@1.2.211 LWA-2026-7367
- beaver-ui-date-range-picker@12.5.3 LWA-2026-7352T1195.002T1059.007T1105T1071.001T1573
- beaver-ui-icon-lock@12.2.3 LWA-2026-7353T1195.002T1059.007T1059.003T1105T1071.001
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.