Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 20 of 37.
- beaver-ui-form-object@12.1.7 LWA-2026-7351T1195.002T1059.007T1105T1071.001T1573
- beaver-ui-items-with-more@12.2.6 LWA-2026-7350T1195.002T1059.007T1105T1071.001T1204.002
- beaver-ui-hooks@12.6.3 LWA-2026-7349T1195.002T1059.007T1105T1071.001T1568.002
- beaver-ui-form@12.6.1 LWA-2026-7348T1195.002T1059.007T1105T1071.001T1573
- beaver-ui-form-modal@12.7.6 LWA-2026-7347T1195.002T1059.007T1105T1071.001T1568.002
- beaver-ui-header@12.3.9 LWA-2026-7346T1195.002T1059.007T1105T1071.001T1102
- beaver-ui-grid@12.7.3 LWA-2026-7345T1195.002T1059.007T1105T1071.001T1204.002
- beaver-ui-layout@12.9.6 LWA-2026-7344T1195.002T1059.007T1105T1071.001T1204.002
- boardwalk-js-tests@1.1.1 LWA-2026-7322T1059.007T1082T1071.001T1041
- arbocrate-sla-prober-arbocrate-sla-prober-core@7.5.8 LWA-2026-7321T1195.002T1059.007T1082T1105T1071.001
- afisha-storybook-default@9.7.10 LWA-2026-7324T1195.002T1059.007T1105T1071.001T1082
- beaver-ui-card-large@9.6.3 LWA-2026-7319T1195.002T1059T1105T1071.001T1204.002
- accounts-loading-state@8.9.4 LWA-2026-7323T1195.002T1059.007T1105T1082T1071.001
- bcore-bravo-eslint-config@9.5.7 LWA-2026-7320T1195.002T1059.007T1082T1105T1071.001
- beaver-ui-actions-button@5.4.7 LWA-2026-7318T1195.002T1059.007T1106T1105T1071.001
- accounts-timeline@9.6.10 LWA-2026-7317T1195.002T1059.007T1105T1082T1071.001
- a.poltoradnev-package-c@6.1.10 LWA-2026-7316T1059.007T1105T1204.002T1082T1071.001
- accounts-final-form@9.9.9 LWA-2026-7315T1195.002T1059.007T1082T1071.001T1105
- aedes_clusters@1.0.1 LWA-2026-7314T1059.007T1082T1041T1071.001
- sui-migration-audit-rules@1.0.0 LWA-2026-7313T1195.002T1059.007T1082T1552.001T1005
- akamaijs@1.0.1 LWA-2026-7312T1059T1059.007T1102T1071.001T1105
- warp-drive-internal-tooling@99.9.9 LWA-2026-7310T1195.002T1059.001T1059.007T1105T1204.002
- mcp-audit-sync-internal@99.9.9 LWA-2026-7309T1195.002T1059.001T1105T1204.002
- node-internal-svg-loader@1.0.0 LWA-2026-7308T1195.002T1059.007T1105T1071.001
- tailwind-opentype@1.2.3 LWA-2026-7303T1195.002T1059.007T1071.001T1573T1105
- vite-tsconfig-svg@1.1.4 LWA-2026-7302T1195.002T1059.007T1105T1071.001
- rollup-plugin-polyfill-hold@1.0.5 LWA-2026-7301T1195.002T1059.007T1105T1071.001
- hardhat-hold@2.21.0 LWA-2026-7299T1195.002T1059.007T1082T1071.001T1041
- ts-poly-utls@1.2.4 LWA-2026-7298T1195.002T1059.007T1105
- @latlongid/location@1.0.1 LWA-2026-7297T1059.007T1082T1041T1071.004
- @bobfrankston/mailx-host@0.1.14 LWA-2026-7296T1195.002
- @ks-openclaw/kim@99.0.0 LWA-2026-7295T1195.002T1059.007T1059.003T1082T1071.001
- postcss-animate-css-vars@2.0.3 LWA-2026-7294T1195.002T1059.007T1059T1082T1071
- @vallensofficial/baileys@9.4.6 LWA-2026-7293T1195.002
- @bobfrankston/mailx-sync@0.1.28 LWA-2026-7291T1195.002
- log-min@1.0.13 LWA-2026-7288T1195.002T1059.007T1059T1105T1071.001
- streak-metrics-math@1.0.1 LWA-2026-7285T1195.002T1059.007T1059.004T1543.002T1053.006
- runtime-sentinel@1.0.2 LWA-2026-7284T1195.002T1059.007T1105T1071.001
- streak-math-metrics@1.0.0 LWA-2026-7279T1195.002T1059.007T1059.004T1543.002T1082
- akamai-sensorv3@1.0.0 LWA-2026-7277T1195.002T1059.007T1027T1027.010T1102
- streak-metrics-core@1.0.0 LWA-2026-7278T1195.002T1059.007T1059T1543.001T1053.003
- supersig@1.0.5 LWA-2026-7276T1195.002T1059.007T1105T1071.001T1573
- @ai-vertical/ai-agent@1.0.0 LWA-2026-7275T1195.002T1059.007T1105T1071.001
- akamai-sensorv2@1.0.0 LWA-2026-7274T1195.002T1059.007T1105T1071.001T1573
- akamai-sensorv1@1.0.0 LWA-2026-7246T1195.002T1059.007T1027T1027.013T1102
- native-hello-plugin@1.2.0 LWA-2026-7244T1059.001T1105T1204.002T1574.002
- streak-metric-core@1.0.0 LWA-2026-7243T1195.002T1059.007T1027T1105T1204.002
- react-fast-refresh-helper@1.2.6 LWA-2026-7242T1195.002T1059.007T1105T1204.002
- rollup-plugins-check@0.0.1 LWA-2026-7241T1195.002T1059.007T1105T1071.001
- multi-acct@1.0.0 LWA-2026-7240T1195.002T1059.007T1105
- merchantweb-lang-cookie-reset@0.0.6 LWA-2026-7239
- commonweb-flow@1.0.0 LWA-2026-7238T1195.002T1059
- kepler@1.0.999 LWA-2026-7250T1195.002T1195
- switchpaymentsapiserv-paypal@2.3.4 LWA-2026-7237T1195.002T1059.007T1082T1071.004T1041
- osinthell@1.9.5 LWA-2026-7236T1059.007T1059.003T1485T1491T1490
- rollup-plugins-polyfills-rode@0.13.4 LWA-2026-7235T1195.002T1059.007T1105T1071.001
- test-flow-entire5@1.0.0 LWA-2026-7234T1195.002T1105
- express-middle@5.5.1 LWA-2026-7233T1195.002T1059.007T1204.002T1055T1027
- add-two-numbers-x7q9m@1.0.0 LWA-2026-7232T1059.007T1552.001T1041T1195.002
- hyper-kube-config@1.1.1 LWA-2026-7231
- test-flow-entire4@1.0.0 LWA-2026-7230T1195.002T1059
- test-flow-entire3@1.0.0 LWA-2026-7229T1195.002T1195
- test-flow-entire2@1.0.0 LWA-2026-7228T1195.002T1105
- test-flow-entire@1.0.0 LWA-2026-7227T1195.002T1105
- testingflow3@1.0.0 LWA-2026-7226T1195.002
- testingflow2@1.0.0 LWA-2026-7225T1195.002T1195
- testingnewflow@1.0.0 LWA-2026-7224T1195.002T1105
- kyksworldcup4@1.0.0 LWA-2026-7223T1195.002T1105
- flat-logger-core@1.0.0 LWA-2026-7222T1195.002T1105
- streak-cal-core@1.0.0 LWA-2026-7221T1195.002T1059.007T1204.002T1105T1071.001
- chai-as-map@2.3.5 LWA-2026-7220T1195.002T1059.007T1027
- streak-view-core@1.0.0 LWA-2026-7219T1059.007T1204.002T1082T1497.001T1105
- streak-grid-core@1.0.0 LWA-2026-7218T1195.002T1059.007T1204.002T1055T1071.001
- streak-daykey-lib@1.0.0 LWA-2026-7216
- streak-int-lib@1.0.0 LWA-2026-7215T1204.002T1059.007T1105T1071.001T1573
- anthropic-setup@1.0.1 LWA-2026-7214T1195.002T1059T1552.001T1071.001T1041
- nagix-nodejs@2.1.6 LWA-2026-7206T1071.001
- test22221@2.2.7 LWA-2026-7211T1195.002T1059.004T1082T1105T1041
- nagixjs@2.1.6 LWA-2026-7210T1195.002T1059.007T1082T1005T1552.001
- test2221@2.2.3 LWA-2026-7207T1059.004T1082T1041
- @mypwn/greatcall.customers.commandapi@99.0.1 LWA-2026-7205T1195.002T1059.007T1082T1552.001T1071.001
- @sapappgyver/appgyver-descriptors@9.9.11 LWA-2026-7204T1195.002T1059.007T1082T1071.004T1041
- @types-beta/sdk@0.1.3 LWA-2026-7200T1195.002T1059.007T1059.003T1071.001T1573
- matlab-azure-devops-extension@1.0.1 LWA-2026-7199T1059.007T1082T1071.001T1041
- wolverinechat@1.0.1 LWA-2026-7197T1059.007T1082T1071.001T1041
- postcss-motion-utils@3.2.7 LWA-2026-7194T1195.002T1059.007T1027T1105T1071.001
- nagix-node@2.1.6 LWA-2026-7193
- @ghost_debugger/nanocache@0.1.1 LWA-2026-7192T1195.002T1059.007T1105T1071.001T1573
- blots@2.1.0 LWA-2026-7188T1059.004T1082T1041
- voicemail@1.0.1 LWA-2026-7187T1059T1082T1071.001T1041
- toll_free@1.0.1 LWA-2026-7186T1059.007T1082T1041T1071.001
- fdd41@1.0.0 LWA-2026-7185T1059.001T1059.007T1053.005T1564.003T1036.005
- chain-analyze@1.0.2 LWA-2026-7183T1195.002T1059.007T1105T1071.001T1204.002
- fluid-type-ui@2.0.8 LWA-2026-7182T1195.002T1059.007T1082T1071.001T1573
- @adominadmininstr/fmt-date-helper@1.0.0 LWA-2026-7181T1195.002T1059.007T1082T1615T1552.001
- @adominadmininstr/date-util-helper@1.0.0 LWA-2026-7180T1195.002T1059.007T1082T1615T1071.001
- array-sort-helper@1.0.0 LWA-2026-7179T1195.002T1059.007T1082T1087.001T1615
- json-to-table-util@1.0.0 LWA-2026-7178T1059.007T1082T1083T1614T1071.001
- style-class-utils@1.0.0 LWA-2026-7176T1195.002T1059.007T1082T1615T1071.001
- text-line-parser@1.0.0 LWA-2026-7177T1195.002T1059.007T1082T1087.001T1057
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.