Confirmed malicious npm packages

Every package version the probe has confirmed malicious and published, newest first. 3,101 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. Page 32 of 32.

1. forge-jsxy@1.0.91 2026-05-26 LWA-2026-0060
   T1059T1546.016

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.