Leitwacht LEITWACHT Threat Intel

Confirmed malicious npm packages

Every package version the probe has confirmed malicious and published, newest first. 3,005 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. Page 31 of 31.

  1. @pisell/pisellos@2.2.164 LWA-2026-0033
    T1195.002
  2. @pisell/pisellos@2.2.168 LWA-2026-0034
    T1195.002
  3. @pisell/pisellos@2.2.169 LWA-2026-0035
    T1195.002
  4. @pisell/pisellos@2.2.173 LWA-2026-0036
    T1195.002
  5. forge-jsxy@1.0.91 LWA-2026-0060
    T1059T1546.016

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.