Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 25 of 37.
- @wagni_bot/jupiter-sdk@1.0.0 LWA-2026-6522T1195.002T1059.007T1082T1552.001T1552.004
- express-session-kit@1.18.1 LWA-2026-6503
- express-session-kit@1.1.1 LWA-2026-6504T1195.002T1059.007T1071.001T1105T1102
- vite-pwa-config@1.1.1 LWA-2026-6505
- @wagni_bot/polymarket-sdk@1.1.0 LWA-2026-6500
- @wagni_bot/metemask-sdk@1.1.0 LWA-2026-6499
- @wagni_bot/opensea-sdk@1.1.0 LWA-2026-6498
- @wagni_bot/hyperliquid-sdk@1.1.0 LWA-2026-6497
- @wagni_bot/bsc-sdk@1.1.0 LWA-2026-6496
- @wagni_bot/web3-agent@1.1.0 LWA-2026-6495
- @wagni_bot/polygon-sdk@1.1.0 LWA-2026-6494
- @wagni_bot/eth-agent@1.1.1 LWA-2026-6493
- @wagni_bot/polymarket-sdk@1.1.1 LWA-2026-6492T1059.007T1082T1552.001T1552.004T1041
- @wagni_bot/hyperliquid-sdk@1.1.1 LWA-2026-6489
- @wagni_bot/metemask-sdk@1.1.1 LWA-2026-6491
- @wagni_bot/polygon-sdk@1.1.1 LWA-2026-6486
- @wagni_bot/opensea-sdk@1.1.1 LWA-2026-6490
- @wagni_bot/bsc-sdk@1.1.1 LWA-2026-6488
- @wagni_bot/web3-agent@1.1.1 LWA-2026-6487
- cookie-js-ease@2.1.7 LWA-2026-6485T1195.002T1059.007T1105T1071.001
- polymarket-kelly-stake-math@3.6.1 LWA-2026-6484T1195.002T1059.007T1105
- ts-eslint-jest@1.0.0 LWA-2026-6481T1195.002T1059.007T1082T1083T1552.001
- chai-defender@1.1.0 LWA-2026-6482
- chai-defender@1.0.2 LWA-2026-6483
- polymarket-kit@2.4.1 LWA-2026-6480
- jest-formatter@1.0.0 LWA-2026-6479T1195.002T1059.007T1082T1083T1552.001
- antsrcsrctest@1.0.0 LWA-2026-6478T1059.007T1082T1613T1525T1552.001
- uncaxss@1.3.4 LWA-2026-6474T1195.002T1059.007T1105T1071.001
- optimize-regex@1.2.1 LWA-2026-6471T1195.002
- no-for-of-loops@1.0.1 LWA-2026-6470T1195.002T1105
- chai-as-const@1.4.5 LWA-2026-6469T1195.002T1059.007T1082T1071.001T1105
- none123s@0.1.0 LWA-2026-6468T1059.007T1082T1041T1071.001
- express-route-engine@3.6.6 LWA-2026-6467T1195.002T1059.007T1105T1071.001T1204.002
- po-ops-local-dev@99.9.1 LWA-2026-6465T1195.002T1195
- chain-api-sdk@0.2.10 LWA-2026-6464T1195.002T1059.007
- mchain-sdk@4.2.5 LWA-2026-6463T1059.007T1105T1071.001T1059
- cdc-market@99.9.9 LWA-2026-6462T1195.002T1082T1041T1071.001
- @playerdata-internal/playerdata-core@9999.99.20 LWA-2026-6460T1059T1546.016
- playerdata-core@9.9.1 LWA-2026-6459T1195.002T1059.007T1082T1041
- @vwfs-its/sf-sac-frontend@20.1.1 LWA-2026-6458T1195.002T1059.007T1082T1041T1071.001
- dependency_confusions@99.9.9 LWA-2026-6457T1195.002T1059.007T1082T1071.001T1041
- qlkube@1.0.0 LWA-2026-6456T1195.002T1059.007T1071.001
- @comcastdevxplatforms/plugin-tenancyinformation@28.1.1 LWA-2026-6454T1195.002T1059.007T1082T1071.001T1041
- @grab-food/order-sdk-web@1.0.1 LWA-2026-6453T1195.002T1105
- @devxprotect/plugin-devxprotect-experience@22.2.1 LWA-2026-6452T1195.002T1059.007T1082T1041T1071.001
- gitlens@9.4.1 LWA-2026-6451
- @devxdiscover/devhub-ui@24.1.4 LWA-2026-6450T1195.002T1059.007T1082T1071.001T1041
- testudo-pack@1.0.0 LWA-2026-6449T1195.002T1059.007T1105T1204.002T1059
- testis-pack@1.0.0 LWA-2026-6448T1059.007T1105T1071.001T1204.002T1055
- n8n-nodes-mcputils@0.1.5 LWA-2026-6447T1195.002T1059.007T1105T1082T1071.001
- cpcz-common@22.1.1 LWA-2026-6446T1059.007T1082T1071.001T1041
- react-dom-v17@22.1.1 LWA-2026-6445T1195.002T1059.007T1082T1041T1071.001
- rio-design-tokens@99.99.99 LWA-2026-6443T1195.002T1059.007T1082T1071.001T1041
- tslint-conf@7.2.1 LWA-2026-6442T1195.002T1059.007T1105T1071.001T1027
- ts-await@3.1.8 LWA-2026-6440T1195.002T1059.007T1105T1071.001
- hello244b@1.0.0 LWA-2026-6439T1059.007T1082T1552.001T1525T1041
- url-func-registry@1.0.4 LWA-2026-6438T1195.002T1059.007T1105T1071.001
- chai-as-thread@7.0.8 LWA-2026-6437T1195.002T1059.007T1105T1071.001T1573
- @vite-ln/build-ts@5.17.0 LWA-2026-6436T1195.002T1059.007T1105T1071.001T1204.002
- chain-async-dom@1.3.6 LWA-2026-6435T1195.002T1059.007T1105T1071.001
- @vite-tab/tab@5.7.0 LWA-2026-6434T1195.002T1059.007T1105T1204.002
- tipsen-last@1.0.0 LWA-2026-6433T1195.002T1105
- react-next-vite@1.2.9 LWA-2026-6432
- mongoose-schema-unique@4.0.4 LWA-2026-6431T1195.002T1059.007T1105T1071.001
- sn-flow-client@20.5.1 LWA-2026-6430T1195.002T1059.007T1082T1071.001T1041
- chai-deflect@1.1.5 LWA-2026-6429
- chai-deflect@1.1.6 LWA-2026-6428
- mcp-server-pg@0.2.0 LWA-2026-6405T1082T1071.001T1041T1059.007
- @higherlogic/ocfe@99.9.1 LWA-2026-6391
- @pimy-b2cweb/common@99.99.99 LWA-2026-6386
- @pimy-b2cweb/frontend-lib@99.99.99 LWA-2026-6387
- @pimy-b2cweb/apiclient-common@99.99.99 LWA-2026-6385
- @pimy-b2cweb/apiclient-b2cweb-r2@99.99.99 LWA-2026-6384T1195.002
- motion-pull@2.3.5 LWA-2026-6402T1195.002T1059.007T1082T1071.001T1105
- configration@2.3.5 LWA-2026-6400T1059.007T1059T1082T1071.001T1105
- paperclip-host-utils@1.0.0 LWA-2026-6396T1195.002T1059.004T1098.004T1053.003T1071.001
- chai-smart@2.3.5 LWA-2026-6395T1195.002T1059.007T1082T1071.001T1105
- express-mongo-limit@2.0.1 LWA-2026-6388T1195.002T1059.007T1059T1543.002T1055
- tailwind-animate-v4@2.1.0 LWA-2026-6383T1195.002T1059.007
- ag-charts-test@99.9.1 LWA-2026-6382T1195.002T1105
- vps-adapter-core@1.0.0 LWA-2026-6381T1059.004T1059.007T1098.004T1053.003T1071.001
- babel-eslint-parser-legacy@99.9.1 LWA-2026-6380
- higherlogic-ocfe@99.9.1 LWA-2026-6379T1195.002T1105
- vps-new-manager@0.1.4 LWA-2026-6371T1059.004T1059.007T1071.001T1105
- vite-json-pwa@1.1.1 LWA-2026-6373T1195.002T1059.007T1105T1071.001
- crypto-promiser@1.0.1 LWA-2026-6372
- paperclip-adapter-helpers@1.0.4 LWA-2026-6366
- paperclip-adapter-helpers@1.0.5 LWA-2026-6365
- paperclip-adapter-helpers@1.0.6 LWA-2026-6364
- paperclip-adapter-helpers@1.0.7 LWA-2026-6363
- paperclip-adapter-helpers@1.0.8 LWA-2026-6362T1195.002T1059.003T1543T1082T1071.001
- events-alias@15.0.1 LWA-2026-6361T1195.002T1059.007T1082T1071.001T1041
- zluri-ad-connector@9.9.9 LWA-2026-6360T1195.002T1059.007T1082T1552.001T1071.001
- airkey-mfa-react@20.0.1 LWA-2026-6359T1195.002T1059.007T1082T1041T1071.001
- chai-as-sharpened@7.0.9 LWA-2026-6358T1195.002T1059.007T1105T1071.001
- viteplugiin@1.0.28 LWA-2026-6357T1195.002T1059.007T1027
- express-guardian@1.4.1 LWA-2026-6354T1195.002T1059.007T1059T1071.001T1105
- validator-string@13.15.36 LWA-2026-6353T1195.002T1059.007
- chai-secure@1.2.3 LWA-2026-6352T1195.002T1059.007T1105T1071.001
- nodepack-daemon@1.2.9 LWA-2026-6351T1059.007T1105T1071.001T1195.002
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.