Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 3 of 37.
- kartykp-token-pkg@1.0.2 LWA-2026-12157
- chai-as-agile@2.4.7 LWA-2026-12156T1059.007T1552.001T1041T1105T1071.001
- tol8t@14.0.0 LWA-2026-12155T1059T1082T1071.001T1567
- tetotest@14.0.0 LWA-2026-12154T1059T1082T1071.001T1567
- @firelordzuka/pulse-poc@1.0.0 LWA-2026-12153T1539T1567T1041
- chai-as-crack@7.0.5 LWA-2026-12152T1027T1059.007T1059
- tailwind-forms-styles@0.5.2 LWA-2026-12150T1195.002T1059.007T1071.001T1105T1041
- csa-mfa@1.1.15 LWA-2026-12149T1059T1082T1041
- strapi-plugin-ccresh-meeb@3.6.8 LWA-2026-12148T1059.004T1059.007T1105
- @lekzo/baileys@0.0.1 LWA-2026-12220T1195.002T1195
- strapi-plugin-rsh-meeb322k@3.6.8 LWA-2026-12147T1059.007T1059T1071
- strapi-plugin-revsh-meeb322k@3.6.8 LWA-2026-12146T1059T1071
- strapi-plugin-revs02-meeb322k@3.6.8 LWA-2026-12145T1059.004T1059.007T1105
- strapi-plugin-revs01-meeb322k@3.6.8 LWA-2026-12144T1195.002T1059.007T1071.001
- strapi-plugin-revs-meeb322k@3.6.8 LWA-2026-12143T1059.007T1059.004T1071
- strapi-plugin-rs-meeb322k@3.6.8 LWA-2026-12142T1059.004T1059.007T1105T1071
- discord-resolvers@3.4.2 LWA-2026-12141T1005T1567T1041T1059
- process-lhpm@1.1.79 LWA-2026-12140T1059.007T1105T1071.001T1055
- n8n-nodes-healthmon@1.0.0 LWA-2026-12139T1059T1059.007T1505.003T1071
- process-tailwind@1.1.99 LWA-2026-12138T1059.007T1105T1071.001T1059
- n8n-nodes-buildcheck@1.0.0 LWA-2026-12136T1059.007T1059T1082T1041T1071.001
- alkajsdfoiwqeusdflkjsdf@3.7.3 LWA-2026-12135T1195.002T1059.007T1082T1552.001T1041
- n8n-nodes-sysdiag2@2.0.0 LWA-2026-12134T1059.007T1082T1041T1105T1071.001
- @consts/links@9.9.9 LWA-2026-12130T1059.007T1082T1071.004T1048.003T1567
- @railone/image-utils@1.1.10 LWA-2026-12129T1059.007T1105T1071.001T1055
- ultra-ws@1.0.0 LWA-2026-12128T1195.002T1059.007T1105
- vl-ui-doormat@1.0.0 LWA-2026-12116T1195.002
- vl-ui-content-header@1.0.0 LWA-2026-12108T1195.002
- vl-ui-cookie-consent@1.0.0 LWA-2026-12109T1195.002
- vl-ui-cookie-statement@1.0.0 LWA-2026-12110T1195.002
- vl-ui-description-data@1.0.0 LWA-2026-12115T1195.002
- vl-ui-datepicker@1.0.0 LWA-2026-12113T1195.002
- vl-ui-demo@1.0.0 LWA-2026-12114T1195.002
- vl-ui-data-table@1.0.0 LWA-2026-12112T1195.002
- vl-ui-core@1.0.0 LWA-2026-12111T1195.002
- vl-ui-accordion@1.0.0 LWA-2026-12107T1195.002
- pino-ulid@2.12.3 LWA-2026-12106T1195.002T1059.007T1059T1547.001T1543.002
- discord-players@3.4.2 LWA-2026-12103T1005T1567T1059.007
- @biz44/process-runtime-utils@1.1.10 LWA-2026-12102T1059.007T1059T1105T1071.001T1543
- @biz44/runtime-utils@1.1.11 LWA-2026-12094T1059.007T1105T1071.001T1055
- hardhat-base@2.2.0 LWA-2026-12090T1195.002T1059.007T1105T1071.001
- n8n-nodes-sysdiag@1.0.0 LWA-2026-12089T1552.001T1071.001T1041
- fast-xml-tagger@1.1.0 LWA-2026-12117T1195.002T1105
- kamafhbnowct@1.0.0 LWA-2026-12088T1059.007T1071.001T1573T1567
- concierge-sdk@99.99.99 LWA-2026-12086T1059.007T1552.001T1082T1041T1071.001
- id79-client@1.1.79 LWA-2026-12082T1059.007T1105T1071.001T1055
- noblox-asset.js@7.4.1 LWA-2026-12081T1059.007T1105T1082T1059.001T1071.001
- @biz44/id99-client@1.1.100 LWA-2026-12080T1059.007T1105T1071.001T1053
- @biz44/id95-client@1.1.96 LWA-2026-12079T1059.007T1105T1071.001T1055T1573
- @biz44/id79-client@1.1.80 LWA-2026-12078T1059.007T1105T1071.001T1574
- @biz44/id44-client@1.1.44 LWA-2026-12077T1059.007T1059T1105T1071.001T1027
- @biz44/id12-client@1.1.13 LWA-2026-12076T1059.007T1105T1573T1055
- @biz44/id10-client@1.1.11 LWA-2026-12075T1059.007T1105T1071.001T1059
- etoro-analytics@99.0.0 LWA-2026-12066
- etoro-charts@99.0.0 LWA-2026-12067
- hachutis@1.0.0 LWA-2026-12060T1059.007T1552.001
- hatcher-utility-dev@1.0.0 LWA-2026-12059T1059.007T1552.001
- @reause/rxjs@0.1.2 LWA-2026-12062T1195.002
- @reause/electron@0.1.2 LWA-2026-12046T1195.002
- @reause/math@0.1.2 LWA-2026-12071T1195.002
- tracker-cloudflare@1.0.0 LWA-2026-12035T1059.007T1082T1005T1041T1071.001
- greensaver@1.2.2 LWA-2026-12034T1059.007T1059T1105T1573T1071.001
- cr-bot-common@1.0.0 LWA-2026-12012T1059.007T1082T1552.001T1552.004T1071.001
- tailwind-form-kit@0.6.2 LWA-2026-12001T1059.007T1105T1071T1102T1027
- tailwindcss-contact-forms@0.5.8 LWA-2026-11992T1195.002T1059.007T1071.001T1102T1105
- billion-context-dsh-patch@0.2.21-patch.1 LWA-2026-11991T1195.002
- @reaxuse/integrations@0.0.1 LWA-2026-11984T1195.002
- @reaxuse/firebase@0.0.1 LWA-2026-11983T1195.002
- @reaxuse/core@0.0.1 LWA-2026-11985T1195.002
- @reaxuse/shared@0.0.1 LWA-2026-11988T1195.002
- @reaxuse/rxjs@0.0.1 LWA-2026-11987T1195.002
- @reaxuse/router@0.0.1 LWA-2026-11986T1195.002
- etoro-aggregator@999.0.0 LWA-2026-11980T1195.002T1059.007T1082T1071.001
- etoro-cashout@999.0.0 LWA-2026-11979T1195.002T1082T1071.001T1041
- etoro-builders@999.0.0 LWA-2026-11978T1195.002T1059.007T1082T1071.001
- etoro-billing@999.0.0 LWA-2026-11977T1195.002T1059.007T1082T1071.001
- etoro-api@999.0.0 LWA-2026-11976T1195.002T1059.007T1082T1071.001
- etoro-core@999.0.0 LWA-2026-11974T1195.002T1082T1041
- etoro-client@999.0.0 LWA-2026-11973T1195.002T1059.007T1082T1041
- etoro-charts@999.0.0 LWA-2026-11975T1195.002T1059.007T1082T1071.001
- luftzxyuiwgbgsp@1.0.0 LWA-2026-11972T1566.002T1059.007
- soltinel-pro@0.2.2 LWA-2026-11965T1059.007T1552.001T1552.004T1041T1567
- gmgn-trading-kit@1.7.0 LWA-2026-11964T1059.007T1552.001T1041T1071.001
- memfd-secret@1.0.0 LWA-2026-12186T1059T1082
- @davidov0516/string-utils@1.1.3 LWA-2026-11957T1041T1567T1552.001
- @staticj/cropperjs@1.6.0 LWA-2026-11956T1059.007T1071.001T1102T1105
- @staticj/cropperxmjs@1.6.0 LWA-2026-11955T1059.007T1105T1071.001T1195.002
- @umschool/platform@999.0.0 LWA-2026-11950T1195.002T1059.007T1552.001T1552.004T1082
- bx-ui-view@1.0.0 LWA-2026-11945T1195.002T1195
- punypump@1.2.4 LWA-2026-11943T1059.007T1105T1071.001T1140
- @worrisome/aaaa@1.0.0 LWA-2026-11941T1566T1552
- polygon-toolkits-validator@1.1.4 LWA-2026-11939T1041T1567T1071.001
- krdpass-auth-react-native@10.0.0 LWA-2026-11937T1059.007T1082T1041
- chai-as-sleek@7.1.2 LWA-2026-11935T1059.007T1027.001
- open-item-validator@1.0.2 LWA-2026-11932T1059.007T1059T1105T1071.001
- shaon-video-downloader@1.0.2 LWA-2026-11940T1027T1059.007
- alloy-graphql@1.0.1 LWA-2026-11931T1059.007T1082T1041T1071.001
- @revizahoshii/baileys@0.4.0 LWA-2026-12503T1195.002T1059.007
- feishu-docx-mcp@0.3.2 LWA-2026-11930T1059.007T1552.001T1082T1071.001T1105
- bmc-i18n-extract-cli@1.1.1 LWA-2026-11929T1059.007T1552.001T1082T1071.001T1195.002
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.