Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 2 of 37.
- @nimbusedge2/x@1.1.1 LWA-2026-12292T1059.004T1071.001T1041
- chat-adapter-matrix@99.99.99 LWA-2026-12291T1195.002T1059.007T1071.001
- @nimbusedge2/authxsas1@1.1.0 LWA-2026-12288T1059.007T1552.005T1041
- npmscript_tesstalert_unpkg@1.0.1 LWA-2026-12285T1539T1041
- @nimbusedge2/authxsas@1.1.0 LWA-2026-12284T1059.007T1552.005T1082T1041
- @nimbusedge2/auth@1.1.1 LWA-2026-12283T1059.004T1071.001
- @baanx/abis@9.9.9 LWA-2026-12279T1195.002
- @baanx/blockchain-config@9.9.9 LWA-2026-12280T1195.002
- @baanx/domain@9.9.9 LWA-2026-12282T1195.002
- @baanx/common@9.9.9 LWA-2026-12281T1195.002
- @baanx/solana-lib@9.9.10 LWA-2026-12278T1059.007T1082T1071.001
- @dbbhk/ui-components@99.0.0 LWA-2026-12276T1195.002T1059.007T1082T1552.001T1552.005
- ndmcmsujey@1.0.0 LWA-2026-12273T1195.002
- fdhcxvnwhjiofv@1.0.0 LWA-2026-12272T1189T1059.007T1552.001
- siriusbeyond@1.0.0 LWA-2026-12271T1059.007T1082T1552.001T1071.001T1048
- starbucks-sdk@1.0.0 LWA-2026-12270T1195.002T1059.007T1082T1071.001T1041
- chai-as-viem@1.1.3 LWA-2026-12269T1195.002T1059.007T1552.001T1041T1105
- action-slack-message-root@1.0.1 LWA-2026-12268T1059.007T1082T1041
- testmgkregme@1.0.1 LWA-2026-12267T1059.007T1059T1027T1140
- keroeltopkkk@99.99.99 LWA-2026-12266T1195.002T1059.007T1082T1071.001
- keroeltopkk@99.99.99 LWA-2026-12265T1195.002T1059.007T1082T1071.001
- keroeltopgg@99.99.99 LWA-2026-12264T1082T1071.001T1041
- keroeltop@99.99.99 LWA-2026-12263T1195.002T1059.007T1082T1071.001
- test1ro@99.99.99 LWA-2026-12261T1059.007T1082T1071.001
- bulk-add-sdk@1.99.99 LWA-2026-12260T1059.007T1082T1071.001T1041
- test8999-auth@1.0.1 LWA-2026-12243T1059.007T1082T1041T1071.001
- @insiderintelligence/googleadmanager@9.9.10 LWA-2026-12246
- @shared-runtime/modules@9.9.10 LWA-2026-12228
- test1sdsd2@99.99.99 LWA-2026-12257T1059.007T1071.001
- test1gg234@99.99.99 LWA-2026-12256T1059.007T1071.001
- test1df23@99.99.99 LWA-2026-12254T1195.002T1059.007T1071.001
- test1hh235@99.99.99 LWA-2026-12255T1059.007T1071.001T1195.002
- test12vv36@99.99.99 LWA-2026-12253T1059.007T1071.001
- internallib_v949@1.0.3 LWA-2026-12251T1059.007T1105T1071.001
- melbet-cm@1.0.0 LWA-2026-12252T1195.002
- @shared-web/utils@9.9.10 LWA-2026-12227
- @shared-web/assets@9.9.10 LWA-2026-12229T1027T1036
- catwrestlinghuman@1.0.0 LWA-2026-12248T1059.007T1027.010
- tailwind-form-styles@0.5.1 LWA-2026-12247T1195.002T1059.007T1105T1071.001T1573
- x509-escaping@1.0.1 LWA-2026-12245T1059.007T1082T1071.001T1041
- openmct-heatmap@1.0.1 LWA-2026-12244T1059.007T1082T1071.001T1041
- test899-auth@1.0.1 LWA-2026-12242T1059.007T1082T1048.003T1071.004
- test89-auth@1.0.1 LWA-2026-12241T1059.007T1082T1083T1071.004T1041
- test890-auth@1.0.0 LWA-2026-12240T1059.007T1082T1071.001T1041
- my-ctf-helper-script-9921@1.0.0 LWA-2026-12238T1059.007T1539T1041
- @shared-web/constants@9.9.9 LWA-2026-12234T1195.002
- @shared-web/modules@9.9.9 LWA-2026-12235T1195.002
- @shared-runtime/api@9.9.9 LWA-2026-12231T1195.002
- @shared-web/tracking@9.9.9 LWA-2026-12236T1195.002
- @shared-web/api@9.9.9 LWA-2026-12233T1195.002
- @shared-runtime/config@9.9.9 LWA-2026-12232T1195.002
- lufxchwmxwyps@1.0.0 LWA-2026-12230T1566T1071
- sorrawit-dev-helper@1.0.0 LWA-2026-12223T1059.007T1102T1041
- luftmvfiwgxydes@1.0.0 LWA-2026-12218T1566.002T1059.007
- chai-as-indexed@7.2.8 LWA-2026-12219T1059.007T1105T1041T1552.001
- montreal-core@0.1.0 LWA-2026-12217T1082T1041T1485T1071.001
- hardhat-devkit@2.3.6 LWA-2026-12216T1195.002T1059.007T1027
- catwrestlingbird@1.0.0 LWA-2026-12215T1059.007T1059T1082T1071.001T1105
- @tink/tink-link-core@9.9.10 LWA-2026-12214T1059.007T1082T1071.004T1041
- homestack-cheer@1.1.9 LWA-2026-12213T1059.007T1071.001T1041T1567
- tailwindcss-form-utils@0.5.1 LWA-2026-12212T1195.002T1059.007T1105T1071.001T1102
- chai-testing@1.1.4 LWA-2026-12211T1059.007T1105T1071.001T1059
- test89078-auth@99.99.99 LWA-2026-12210T1082T1071.004T1041
- pflag29424@1.0.0 LWA-2026-12209T1041T1071.001T1552.001
- pflag14570@1.0.0 LWA-2026-12208T1539T1005T1071.001T1041
- pf25133@1.0.0 LWA-2026-12207T1552.001T1071.001T1041
- pf23727@1.0.0 LWA-2026-12206T1539T1041T1071.001
- pf25262@1.0.0 LWA-2026-12205T1539T1567T1041
- tailwindcss-form-ui@0.5.1 LWA-2026-12203T1195.002T1059.007T1082T1071.001T1105
- pulse-pwn-9f3a2@1.0.0 LWA-2026-12202T1539T1567T1071.001
- @vitemirrorte/element-plus-vite-cli@2.9.1 LWA-2026-12201T1195.002T1059.007T1059T1082T1071.001
- chai-as-core@7.0.8 LWA-2026-12200T1195.002T1059.007T1105T1071.001
- hardhat-core@2.1.2 LWA-2026-12197T1059.007T1105T1071.001T1195.002
- laycot@1.3.10 LWA-2026-12196T1059.007T1105T1071.001T1055
- tailwindcss-contact-form@0.5.1 LWA-2026-12195T1195.002T1059.007T1082T1071.001T1105
- tailwindcss-form@0.5.1 LWA-2026-12194T1195.002T1059.007T1105T1071.001T1027
- kartyk-github-token-pkg@1.0.4 LWA-2026-12199
- farplotzy@0.1.0 LWA-2026-12191T1059T1071T1105
- farplotx@1.0.1 LWA-2026-12189T1059T1071.001T1105
- ausitool@1.0.1 LWA-2026-12188T1059T1105T1071
- ragacateslikodi@1.0.1 LWA-2026-12183T1005T1041
- n8n-nodes-metricsagent@1.0.0 LWA-2026-12182T1059.007T1505.003T1082
- feed-widget-helper@1.0.0 LWA-2026-12179T1539T1567T1071.001
- strapi-plugin-osag@3.6.8 LWA-2026-12178T1059.007T1082T1071.001T1041
- strapi-plugin-os-rec@3.6.8 LWA-2026-12177T1059.007T1082T1071.001T1041
- strapi-plugin-feedmeeb@3.6.8 LWA-2026-12176T1059.007T1059.004T1071
- confx1789550882@1.0.0 LWA-2026-12175T1059.007T1082T1539T1071.001T1041
- strapi-plugin-maylog-meeb@3.6.8 LWA-2026-12174T1059T1059.007T1071
- process-mite@1.1.79 LWA-2026-12171T1059.007T1105T1071.001T1059
- element-plus-vite-cli@2.9.3 LWA-2026-12170T1059.007T1059T1071.001T1105T1041
- @asenfotech/unplugin-element-plus@2.9.3 LWA-2026-12169T1195.002T1059T1059.007T1082T1071.001
- strapi-plugin-perev-meeb@3.6.8 LWA-2026-12168T1059.007T1059T1105T1071T1482
- strapi-plugin-pysh-meeb@3.6.8 LWA-2026-12167T1059.007T1059T1071.001T1105
- strapi-plugin-persh-meeb@3.6.8 LWA-2026-12166T1059.007T1059.004T1082T1071.001
- strapi-plugin-ccip-meeb@3.6.8 LWA-2026-12165T1195.002T1059.007T1059T1071.001
- strapi-plugin-conresh-meeb@3.6.8 LWA-2026-12164T1059.007T1059T1071.001T1480T1082
- strapi-plugin-cccon-meeb@3.6.8 LWA-2026-12163T1059.007T1059T1071.001T1082
- strapi-plugin-ccrec-meeb@3.6.8 LWA-2026-12162T1059.004T1059.007T1082T1071.001T1105
- swnwall@1.2.10 LWA-2026-12161T1059.007T1105T1071.001T1059
- engin1@1.3.99 LWA-2026-12160T1059.007T1105T1071.001T1059
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.