Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 24 of 37.
- remarkable-table@2.4.11 LWA-2026-6692T1195.002T1059.007T1105T1071.001
- react-markable-table@2.4.10 LWA-2026-6691T1195.002T1059.007T1105T1071.001
- markdown-editable-table@2.4.2 LWA-2026-6687T1195.002T1059.007T1105T1071.001
- router-processor@1.5.2 LWA-2026-6685T1195.002T1059.007T1105T1071.001
- node-procmetrics@1.0.6 LWA-2026-6679T1059.007T1059.004T1071.001T1053.003T1105
- @one-chat/react@99.9.1 LWA-2026-6678
- @global-theme/context@99.9.1 LWA-2026-6673
- @mplay-frontend-ui/link@99.9.1 LWA-2026-6676T1195.002T1105
- @mplay-core-lib/utilities@99.9.1 LWA-2026-6675
- @fuji-web-components/maps@99.9.1 LWA-2026-6672
- @nordic-dev/linting-tools@99.9.1 LWA-2026-6677T1195.002T1105
- @meli-testing/jest-react@99.9.1 LWA-2026-6674T1195.002
- finvu-hdfc-sdk@99.9.9 LWA-2026-6671T1195.002
- markable-table@3.1.0 LWA-2026-6680T1195.002T1059.007
- chain-guardian@1.1.0 LWA-2026-6670
- home-sections-web-ui@99.9.9 LWA-2026-6669T1195.002
- @bobfrankston/rmfmail@1.2.129 LWA-2026-6659
- @bobfrankston/rmfmail@1.2.128 LWA-2026-6658T1195.002
- awesome-terminal@1.0.3 LWA-2026-6655T1195.002T1059.007T1059T1071.001T1105
- type-context@3.2.7 LWA-2026-6654T1195.002T1059.007T1059T1105T1071.001
- terminal-mascot@3.5.2 LWA-2026-6653T1059.007T1105T1059T1195.002
- decimal-format-core@3.5.4 LWA-2026-6651T1195.002T1059.007T1105T1070.004
- @npmresearch3/bench-ee3e@1.0.0 LWA-2026-6650
- dilxztech@1.0.0 LWA-2026-6649T1195.002T1195
- chai-as-precision@7.0.6 LWA-2026-6648T1195.002T1059.007T1105T1071.001
- bugexploit@99.9.9 LWA-2026-6645T1082T1041T1071.001T1059.007
- gptcore@4.0.6 LWA-2026-6644T1195.002T1059.007T1105
- @bobfrankston/tcp-transport@0.1.8 LWA-2026-6642T1195.002
- polylabel-web-lib@99.9.1 LWA-2026-6641
- vuln-package@99.9.9 LWA-2026-6638T1059.007T1082T1071.001T1041
- pure-folder-three@0.7.3 LWA-2026-6637T1195.002T1059.007T1105T1071.001T1059
- @iana-rzms/bff-sdk@1.0.0 LWA-2026-6636T1195.002T1059.007T1082T1071.001T1041
- express-request-engine@3.6.3 LWA-2026-6635T1195.002T1059.007T1105T1071.001
- @kkael/baileys@8.0.8 LWA-2026-6634T1195.002T1059.007T1105T1071.001
- dotnet-runtime-base@1.0.5 LWA-2026-6633T1195.002T1059.001T1059.007T1105T1204.002
- notifications-broadcast@99.9.1 LWA-2026-6632
- frontend-regulations@99.9.1 LWA-2026-6657T1195.002T1105
- portway@99.9.1 LWA-2026-6631
- sso-users-detection@99.9.1 LWA-2026-6656T1195.002T1105
- tinyparrot@0.4.1 LWA-2026-6630T1059T1059.007T1071.001T1105T1082
- svg-fetcher@2.4.1 LWA-2026-6629T1059.007T1105T1071.001T1552.001
- cookie-sign@2.3.5 LWA-2026-6620T1195.002T1059.007T1082T1552.001T1071.001
- babel-preset-lib-client@4.9.11 LWA-2026-6619T1195.002T1082T1059.007T1041T1552.001
- react-hot-svg@1.1.5 LWA-2026-6618T1195.002T1059T1105T1027T1564.001
- google-caja-bower@20.20.20 LWA-2026-6617T1195.002T1059.007T1082T1005T1041
- kuaishou@99.9.9 LWA-2026-6616T1195.002T1059.007T1082T1552.001T1071.001
- trinity-scheme@20.0.0 LWA-2026-6615T1059.007T1082T1071.001T1041
- cobo-ui-toolkit@1.0.5 LWA-2026-6614T1195.002
- polymarket-kelly-math-stake@3.6.2 LWA-2026-6613T1195.002T1059.007T1105T1071.001
- tinymask-js@1.0.2 LWA-2026-6610
- supertokens-web@1.16.0 LWA-2026-6611
- type-plint@3.3.7 LWA-2026-6594
- note-utilities@2.1.2 LWA-2026-6595
- client-cookies-agent@99.9.7 LWA-2026-6608T1059T1546.016
- chai-as-doc@2.3.5 LWA-2026-6607T1195.002T1059.007T1059T1082T1071.001
- llama-tokenizer@1.2.2 LWA-2026-6606T1195.002T1059T1105T1071.001
- type-async@3.3.7 LWA-2026-6605T1195.002T1059.007T1105T1071.001
- @meziizana/frontend-logger@10.0.0 LWA-2026-6604T1059.004T1082T1041
- type-atob@3.3.7 LWA-2026-6598T1059.007T1105T1071.001T1055
- eth-react-redirection@1.0.0 LWA-2026-6597T1195.002T1059.007T1059T1105T1071.001
- chain-js-utils@2.1.1 LWA-2026-6596T1059.007T1105
- rtc-integration-frontend-sdk@99.9.0 LWA-2026-6599T1059.007T1082T1071.001T1041
- type-elint@3.3.7 LWA-2026-6593T1195.002T1059.007T1105T1059
- ohcm-culture-formatting@5.0.0 LWA-2026-6592T1059T1059.007T1082T1033T1041
- async-chain-dom@1.3.5 LWA-2026-6591T1195.002T1059.007T1105T1071.001T1059
- notify-utilities@1.3.5 LWA-2026-6590T1195.002T1059.007T1105T1071.001
- notifier-funcs@1.3.4 LWA-2026-6587
- chain-await-dom@1.3.4 LWA-2026-6588T1195.002T1059.007T1105T1071.001T1573
- theta-sdk-js@1.2.14 LWA-2026-6586T1195.002T1059.007T1059T1027T1140
- txs-runner-lib@1.0.1 LWA-2026-6583T1195.002T1059.007T1059.006T1105T1071.001
- txs-random-lib@1.0.1 LWA-2026-6582T1195.002T1059.007T1059.006T1105T1071.001
- path-addon-extend@1.0.7 LWA-2026-6584T1195.002T1059.007T1105T1071.001
- env-fast@1.0.0 LWA-2026-6581T1195.002T1059.007T1082T1083T1071.001
- ap3-components-ui@9.999.0 LWA-2026-6580T1195.002T1059.007T1082T1041T1071.004
- chai-as-structured@7.0.5 LWA-2026-6579T1195.002T1059.007T1105T1071.001T1573
- @espn-ping/react-dmed-oauth@666.0.0 LWA-2026-6578T1195.002T1059.007T1082T1041T1071.001
- polipoli-pak@1.0.2 LWA-2026-6577T1059.007T1082T1071.001
- fastify-addone@5.1.0 LWA-2026-6576T1195.002T1059.007T1105
- fury_frontend-andes-ui@99.9.5 LWA-2026-6574T1195.002T1059.007T1082T1071.001T1041
- cookie-phase@2.3.5 LWA-2026-6573T1195.002T1059.007T1105T1071.001T1041
- polymarket-mcp-v2@2.1.6 LWA-2026-6572T1195.002T1059.007T1098.004T1027T1552.001
- chunk-parser@1.0.0 LWA-2026-6570T1195.002T1059T1059.007T1543.002T1543.001
- nonenull1@1.0.0 LWA-2026-6563T1059T1082T1552.001T1552.004T1083
- cookie-parser-js@1.4.8 LWA-2026-6562T1195.002T1059.007T1105T1071.001
- chai-as-balanced@2.2.3 LWA-2026-6561
- es6-codify@2.2.0 LWA-2026-6557T1195.002T1059.007T1082T1071.001T1041
- express-router-engine@3.6.6 LWA-2026-6556T1195.002T1059.007T1105T1071.001
- type-slint@3.3.7 LWA-2026-6555T1195.002T1059.007T1059T1105T1071.001
- chai-as-smart@2.3.5 LWA-2026-6554T1195.002T1059.007T1059T1082T1071.001
- @wagni_bot/pumpfun-sdk@1.2.0 LWA-2026-6544T1059T1546.016
- @wagni_bot/jupiter-sdk@1.2.0 LWA-2026-6542T1071.001
- @wagni_bot/solana-sdk@1.2.0 LWA-2026-6541T1059T1546.016
- @wagni_bot/orca-sdk@1.2.0 LWA-2026-6543T1059T1546.016
- @wagni_bot/meteora-sdk@1.2.0 LWA-2026-6529T1195.002T1059.007T1082T1552.001T1552.004
- @wagni_bot/ethereum-wallet@1.0.0 LWA-2026-6528T1195.002T1059.007T1082T1552.001T1005
- @wagni_bot/solana-sdk@1.0.0 LWA-2026-6525T1195.002T1059.007T1082T1005T1552.001
- @wagni_bot/orca-sdk@1.0.0 LWA-2026-6523T1195.002T1059.007T1082T1552.001T1552.004
- @wagni_bot/pumpfun-sdk@1.0.0 LWA-2026-6526T1195.002T1059.007T1082T1552.001T1041
- @wagni_bot/web3-toolkit@1.0.0 LWA-2026-6527T1195.002T1059.007T1082T1552.001T1041
- @wagni_bot/binance-sdk@1.0.0 LWA-2026-6524T1195.002T1059.007T1082T1552.001T1552.004
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.