Leitwacht LEITWACHT Threat Intel

Confirmed malicious npm packages

Every package version the probe has confirmed malicious and published, newest first. 2,902 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. Page 30 of 30.

  1. @pisell/pisellos@2.2.173 LWA-2026-0036
    T1195.002
  2. forge-jsxy@1.0.91 LWA-2026-0060
    T1059T1546.016

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.