Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 23 of 37.
- @hibachi-xyz/ui@99.0.0 LWA-2026-6841T1195.002T1059T1082T1552.001T1071.001
- @hibachi-xyz/common@99.0.0 LWA-2026-6840T1195.002T1082T1552.001T1041T1071.001
- amdocs-auth-package@114.2.1 LWA-2026-6837
- sync-grove@1.0.1 LWA-2026-6835T1059.007T1105T1071.001T1573
- node-as-api@2.1.6 LWA-2026-6834T1195.002T1059.007T1082T1005T1552.001
- myreviews-core@99.0.0 LWA-2026-6833
- typescript-api-node@2.1.6 LWA-2026-6832T1195.002T1059.007T1082T1005T1552.001
- @npmresearch4/utils@1.0.0 LWA-2026-6831T1195.002
- internallib_v907@1.0.3 LWA-2026-6830T1059.007T1105T1071.001
- @npmresearch4/bench-cbb7@1.0.0 LWA-2026-6829
- @npmresearch4/bench-2c83@1.0.0 LWA-2026-6828
- ddaxx@1.0.0 LWA-2026-6826T1195.002T1059.007T1082T1071.001T1567
- api-rs-tuils@2.1.6 LWA-2026-6824T1195.002T1059.007T1098.004T1082T1005
- xxdxax@1.0.1 LWA-2026-6823T1195.002T1059.007T1082T1552.001T1531
- axios-test-one@1.19.0 LWA-2026-6821T1195.002T1059.007T1071.001T1041
- telemetry-metrics@0.2.1 LWA-2026-6820T1195.002T1105T1059.007T1071.001
- @mp-op-ss-front-lib/tracks@99.9.1 LWA-2026-6818T1195.002
- @cr-invested-ui-components/chart@99.9.1 LWA-2026-6817T1195.002T1195
- metrics-ui@99.9.1 LWA-2026-6813T1195.002T1105
- xxdxa@1.0.5 LWA-2026-6812T1195.002T1059.007T1082T1567T1071.001
- idlive-document-capture-web@14.2.1 LWA-2026-6811T1195.002T1059.007T1082T1041T1071.001
- formatters.ts@14.2.1 LWA-2026-6810T1195.002T1059.007T1082T1041T1071.001
- react-hook-scripts@5.4.2 LWA-2026-6809T1195.002T1059.007T1105T1071.001T1082
- code-formatter-setup@1.0.0 LWA-2026-6808T1195.002T1059.007T1059.004T1105
- commonjs-assert@1.0.3 LWA-2026-6807
- ac-raf-emitter@3.0.1 LWA-2026-6806T1195.002T1059.007T1082T1041
- @sqlite-tag/schema-generator@1.0.2 LWA-2026-6805T1195.002T1059.007T1105T1071.001
- chai-assertix@7.0.6 LWA-2026-6804
- @bobfrankston/rmfmail@1.2.137 LWA-2026-6803
- anya-bail@1.1.5 LWA-2026-6802T1195.002T1059.007
- chai-as-byte@3.1.5 LWA-2026-6800
- ai-pro-sdk@2.0.3 LWA-2026-6799
- react-hook-doms@5.3.1 LWA-2026-6797T1195.002T1059.007T1105T1071.001
- @leviosa86com/leviosa86-test@6.0.0 LWA-2026-6792T1059.007T1082T1041T1071.004
- @debile/require-dir@1.9.1 LWA-2026-6791T1195.002T1059T1071.001T1041
- btree-order-book@1.0.1 LWA-2026-11959
- btree-order-book@1.0.0 LWA-2026-11958
- estore-client@5.0.0 LWA-2026-6790
- npmresearch2026-prov-test@1.0.0 LWA-2026-6788T1195.002
- chain-sdk-js@1.0.3 LWA-2026-6785
- @web3-helpers/core@1.0.5 LWA-2026-6784T1059.007T1082T1552.001T1552.004T1071.001
- assertion-utils-js@2.4.3 LWA-2026-6783T1195.002T1059.007T1027.002T1071.001T1105
- smb-common-uikit@15.2.0 LWA-2026-6782T1195.002T1059.007T1082T1041T1071.001
- ahooks-3.7.8@13.1.1 LWA-2026-6781T1195.002T1059.007T1082T1041T1071.001
- cppt-common@13.1.1 LWA-2026-6780T1195.002T1059.007T1082T1041T1071.001
- utils-style-engine@10.2.4 LWA-2026-6779T1195T1059.007T1082T1071.001T1041
- chai-as-act@1.0.2 LWA-2026-6778
- @risaoffc/baileys@8.0.3 LWA-2026-6777T1195.002T1059.007T1105T1071.001
- ethers-core@6.13.7 LWA-2026-6776T1195.002T1059.007T1082T1552.001T1552.004
- chai-as-sets@3.1.3 LWA-2026-6740T1195.002T1059.007T1105T1071.001T1552.001
- chai-as-hardened@7.0.9 LWA-2026-6732T1195.002T1059.007T1105T1071.001T1573
- bimi-maker@8.2.4 LWA-2026-6771T1059.007T1082T1041T1071.001
- async-mutex-v2@2.1.0 LWA-2026-6772
- @asyncapi/specs@6.11.2 LWA-2026-6769T1195.002T1059.007T1105T1071.001T1564.003
- @asyncapi/generator@3.3.1 LWA-2026-6766
- @asyncapi/generator-components@0.7.1 LWA-2026-6767
- @asyncapi/generator-helpers@1.1.1 LWA-2026-6768T1195.002T1059.007T1059T1564.003T1105
- solana-key-utils@1.0.0 LWA-2026-6762T1059.007T1053.003T1053.005T1543.001T1082
- eth-wallet-helpers@1.0.0 LWA-2026-6761T1195.002T1059.007T1053.003T1053.005T1543.004
- crypto-validate-lib@1.0.0 LWA-2026-6759T1195.002T1059.007T1053.003T1053.005T1543.001
- core-dotenv@1.4.1 LWA-2026-6758T1195.002T1059.007T1105T1071.001T1573
- http-ws-listener@1.0.5 LWA-2026-6754T1195.002T1059.007T1105T1071.001T1573
- layer2-sdk@1.0.1 LWA-2026-6752T1195.002T1059.007T1053.003T1053.005T1543.001
- arb-kit@1.0.1 LWA-2026-6750T1059.007T1053.003T1053.005T1543.001T1027
- base58-utils@1.0.3 LWA-2026-6749T1195.002T1059.007T1053.001T1053.002T1082
- eth-dev@1.0.2 LWA-2026-6748T1195.002T1059.007T1059T1543.001T1053.001
- @vite-js/vui@7.14.16 LWA-2026-6746T1195.002T1059
- abi-encode@1.0.0 LWA-2026-6744T1195.002T1059.007T1053.003T1053.005T1543.001
- @vite-tab/tabui@7.15.16 LWA-2026-6743T1195.002T1059.007T1027
- web-pop@2.3.5 LWA-2026-6742T1195.002T1059.007T1082T1071.001T1105
- @sw-commons-components/message-upsell@99.9.1 LWA-2026-6739
- @spending-behavior-ui/widget-insights@99.9.1 LWA-2026-6738T1195.002T1105
- @spending-behavior-ui/cashflow-widget@99.9.1 LWA-2026-6741
- @finance-ui/snackbar-ifpe@99.9.1 LWA-2026-6735
- @finance-ui/finance-view@99.9.1 LWA-2026-6736
- process-status-widget@99.9.1 LWA-2026-6737T1195.002T1105T1059.007
- elsisi-cli@9.9.9 LWA-2026-6734T1195.002
- chai-as-auth@2.3.5 LWA-2026-6733T1195.002T1059.007T1552.004T1071.001T1105
- polymarket-bot-logger@1.0.1 LWA-2026-6731T1195.002T1059.007T1105T1102
- @sqlite-panel/createsql@1.0.0 LWA-2026-6728T1195.002T1059.007T1105T1071.001
- type-unique@3.1.3 LWA-2026-6727T1059.007T1105T1071.001T1055
- type-swap@3.1.3 LWA-2026-6726T1195.002T1059.007T1105T1071.001
- test_adminet@99.9.9 LWA-2026-6725T1195.002T1059.007T1082T1071.001T1041
- monitoring-service-util@1.0.0 LWA-2026-6724T1195.002T1059.007T1552.001T1082T1071.001
- type-astr@3.2.3 LWA-2026-6723T1059.007T1105T1071.001T1055
- chai-as-verified@7.1.5 LWA-2026-6722T1195.002T1059.007T1105T1071.001T1573
- node-fsagent@3.69.0 LWA-2026-6721T1027T1001.002
- polymarket-stake-kelly-math-check@3.5.2 LWA-2026-6720T1195.002T1059.007T1071.001T1105
- route-processor@3.1.5 LWA-2026-6719T1195.002T1059.007T1105
- font-huge@2.5.3 LWA-2026-6718T1195.002T1059.007T1105T1071.001T1082
- polymarket-stake-kelly-math@3.8.2 LWA-2026-6717T1195.002T1059.007T1105T1071.001
- polymarket-math-stake-kelly@3.7.2 LWA-2026-6716T1195.002T1059.007T1105T1071.001
- gifuct@2.1.2 LWA-2026-6715T1195.002T1059.007T1105T1071.001
- @sqlite-group/schema-generator@1.0.2 LWA-2026-6714T1195.002T1059.007T1105T1071.001
- gptlite@4.0.8 LWA-2026-6712T1195.002T1059.007T1105
- datavaultx@1.7.1 LWA-2026-6709T1195.002T1059.007T1105
- auth-gen-next@1.7.13 LWA-2026-6708T1195.002T1059.007T1082T1552.001T1071.001
- node-sysmon-native@1.0.0 LWA-2026-6707T1195.002T1059.004T1059.007T1082T1071.001
- @sof-assistant-fe-lib/vertical-faqs@99.9.1 LWA-2026-6702T1195.002
- font-hub@1.5.2 LWA-2026-6701T1195.002T1059.007T1105T1071.001T1082
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.