Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,888 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 33 of 39.
- wp-boilerplate@1.0.1 LWA-2026-5522T1195.002
- work-planner-client@1.0.0 LWA-2026-5521T1195.002T1059T1082T1041
- chai-solidity-testkit@1.6.1 LWA-2026-5519T1195.002T1059.007T1105T1071.001
- workbox-stable-xyz@1.0.0 LWA-2026-5517T1195.002T1059.007T1082T1071.001T1041
- wordsmith-kit@1.0.0 LWA-2026-5516T1195.002T1059.007T1059T1564.003T1071.001
- wm-idp-sdk@1.2.0 LWA-2026-5514T1195T1195.002
- withnotification@55.33.111 LWA-2026-5513T1059.007T1082T1074
- wisdomtreetest@1.0.1 LWA-2026-5512T1195.002T1059.004T1082T1552.001T1071.001
- winutils-fetch@2.0.0 LWA-2026-5511T1195.002T1059.007T1105
- winston-prism@1.0.1 LWA-2026-5510T1620
- winston-js-express@1.0.5 LWA-2026-5503T1195.002T1059.007
- wind_css@4.0.13 LWA-2026-5502T1195.002T1059.007T1497T1082T1071.001
- wime-zle@1.1.4 LWA-2026-5501T1059.007T1082T1552.001T1041
- pretie_x2@3.8.5 LWA-2026-5498T1195.002T1059.007T1105T1071.001T1564.003
- web-streams-shim@1.0.0 LWA-2026-5497T1195.002
- pretie_x1@3.8.5 LWA-2026-5496T1195.002T1059.007T1105T1071.001
- web-pool@2.3.5 LWA-2026-5488T1059.007T1082T1071.001T1105T1041
- webpack-patch@1.1.7 LWA-2026-5487T1195.002T1059T1059.007T1105T1071.001
- wordpad-text-ui@1.0.0 LWA-2026-5486T1195.002T1059.007T1105T1071.001
- check-ulid@3.0.2 LWA-2026-5485T1195.002T1059.007T1059T1543.002T1053.005
- webpack-cdn-fetcher@1.0.1 LWA-2026-5484T1195.002T1059.007T1105T1071.001T1082
- web-examples@55.33.111 LWA-2026-5483T1059.007T1082
- web3logger@1.1.1 LWA-2026-5478T1027
- web3-deploy-helper@1.0.0 LWA-2026-5474T1059.007T1552.001T1552.004T1041
- web3-core-utils@4.3.5 LWA-2026-5472T1195.002T1059.007T1082T1555.003T1552.001
- weavedb-sdk@0.45.3 LWA-2026-5470T1195.002T1059.004T1204.002T1552.001T1071.001
- weavedb-node-client@0.45.3 LWA-2026-5469T1195.002T1059.004T1204.002T1105
- weavedb-client@0.45.3 LWA-2026-5468
- weavedb-base@0.45.3 LWA-2026-5467T1195.002T1059T1204.002
- wao@0.41.2 LWA-2026-5466
- walletconnectionjs@1.1.1 LWA-2026-5465T1195.002T1059.007T1027T1041
- wac-atl-context@99.9.1 LWA-2026-5463T1195.002T1195
- vui-gateway@45.0.0 LWA-2026-5459T1195.002T1105
- vue-template-compiler-plugin@2.7.16 LWA-2026-5450T1195.002T1059.007T1059T1082T1071.001
- vue-plugin-bomb@1.0.1 LWA-2026-5449T1195.002T1059.007T1485T1529
- vourfly-tele@4.7.6 LWA-2026-5442T1195.002T1059.007T1105T1552.001T1485
- vl-ui-code-preview@10.1.1 LWA-2026-5440T1195.002T1059.004T1082T1071.001T1041
- vl-ui-contact-card@10.1.1 LWA-2026-5441T1195.002T1059T1082T1041
- vl-ui-button@10.1.1 LWA-2026-5437T1195.002T1059.007T1082T1071.001T1041
- vl-ui-body@10.1.1 LWA-2026-5435T1059.004T1082T1071.001T1119
- vl-ui-action-group@10.1.1 LWA-2026-5433T1195.002T1082T1071.001T1567
- vl-ui-breadcrumb@10.1.1 LWA-2026-5436T1195.002T1059.004T1082T1071.001T1041
- vl-ui-checkbox@10.1.1 LWA-2026-5438T1195.002T1059.004T1082T1071.001
- vl-ui-alert@99.99.2 LWA-2026-5434T1195.002T1059.004T1082T1071.001T1041
- vl-ui-accessibility@99.99.1 LWA-2026-5432T1195.002T1059.004T1082T1041
- vite-plugin-vue-extend@1.0.9 LWA-2026-5429T1485T1059.007T1070.004
- vite-plugin-bomb-extend@2.0.0 LWA-2026-5421T1195.002T1059.007T1485T1529
- vite-plugin-bomb@2.0.0 LWA-2026-5420T1195.002T1059.007T1485T1529
- vite-enhancer-config@1.2.1 LWA-2026-5415T1195.002T1059.007T1105T1071.001T1562.009
- @dilxzphrine/libsignal-node@2.5.0 LWA-2026-5414T1195.002T1059T1071.001
- @httpactions/encode-url@1.0.0 LWA-2026-5409T1059.007T1082T1071.001T1105T1573
- @vosslang/cli-linux-arm64@0.1.1 LWA-2026-5411
- viem-ethereum@2.47.9 LWA-2026-5407T1059.007T1552.004T1567T1195.002
- vend-utilities@14.12.11 LWA-2026-5406T1059.007T1082T1071.001T1041T1195.002
- boardflow@1.1.4 LWA-2026-5405T1195.002T1059.007T1027.002T1105T1071.001
- vfat-tools@2.0.0 LWA-2026-5403T1195.002T1059.007T1552.001T1552.004T1082
- totally-safe-util@1.0.1 LWA-2026-5304
- typescript-util-core@7.1.3 LWA-2026-5349
- typescript-util-core@7.1.5 LWA-2026-5350
- @sfhbdrffthger/boardstep@1.0.0 LWA-2026-5401T1059T1059.007T1105T1071.001
- vite-config-field@1.1.0 LWA-2026-5399T1195.002T1059T1059.007T1105T1071.001
- vault-strategies@999.0.0 LWA-2026-5398T1195.002T1059.007T1082T1552.001T1071.001
- var-helper-kit@1.0.1 LWA-2026-5391T1195.002T1059.007T1082T1071.001T1041
- sam-package@1.0.1 LWA-2026-5400T1071.001T1041
- @resolvx/core@2.4.2 LWA-2026-5390T1195.002T1059.007T1082T1071.001T1105
- axiosqqq@1.16.3 LWA-2026-5431T1195.002
- flow-lending-sdk@9.9.9 LWA-2026-5389T1195.002T1059.007T1082T1552.001T1552.004
- bodega-sdk@9.9.9 LWA-2026-5386T1195.002T1059.007T1082T1552.001T1071.001
- surf-lending@9.9.9 LWA-2026-5388T1195.002T1059.007T1082T1552.001T1041
- flowdefi@9.9.9 LWA-2026-5385T1195.002T1059.007T1082T1552.001T1041
- flowcardano@9.9.9 LWA-2026-5387T1195.002T1059.007T1082T1552.001T1071.001
- flow-lending@9.9.9 LWA-2026-5384T1195.002T1059.007T1082T1552.001T1071.001
- ux-metrics-client-interaction-subscriber@45.0.0 LWA-2026-5383T1195.002T1105
- bubblestr@1.1.4 LWA-2026-5382T1059.007T1105T1027T1564.003
- util-free-ports@3.1.2 LWA-2026-5380T1195.002T1059.007T1480T1027T1082
- uphold-sdk-javascript-extensions@99.9.10 LWA-2026-5377T1195.002T1195.001
- u-paging@0.0.0 LWA-2026-5376T1195.002T1656
- vitest-pro@7.0.4 LWA-2026-5375T1195.002T1059.007T1053.005T1543.004T1547.001
- unico-check@9.9.9 LWA-2026-5372T1195.002T1059.004T1082T1041T1071.001
- unicocheck-ios@9.9.9 LWA-2026-5371T1195.002T1059.007T1082T1071.001T1041
- unico-android@9.9.9 LWA-2026-5373T1195.002T1059.004T1082T1041T1071.001
- cardano-addresses-docs@1.0.1 LWA-2026-5370T1195.002T1059.007T1082T1033T1005
- unicode-colors@4.1.4 LWA-2026-5369T1059.007T1082T1497T1071.001T1105
- ultra-base64-math@1.0.2 LWA-2026-5365T1195.002T1027T1027.010
- umi-preset-rce-jytest@1.0.1 LWA-2026-5366T1195.002T1059.007T1082T1552.001T1005
- field-plus@99.99.1 LWA-2026-5364T1195.002T1059.004T1082T1071.001T1041
- ui-core-system@1.0.3 LWA-2026-5358T1195.002T1059.007T1027.010T1027.002T1204.002
- ug-env-switch-ball@7.9.9 LWA-2026-5357T1059.007T1082T1071.004T1048
- ugent_uws@10.9.11 LWA-2026-5356T1059.004T1082T1071.001
- ogd-analytics@1.0.0 LWA-2026-5352T1059.004T1082T1041T1071.001
- dms-backend@1.0.0 LWA-2026-5353T1059T1082T1041
- ogd-platform@1.0.0 LWA-2026-5354T1059.007T1082T1041
- nic-datagov@1.0.0 LWA-2026-5355T1059.004T1082T1041
- typescript-util-core@3.5.0 LWA-2026-5348T1059.007T1071.001T1082T1552.001T1041
- twig.extras@99.99.10 LWA-2026-5345
- twig.extras@99.99.9 LWA-2026-5347
- twcompose-utils@0.7.6 LWA-2026-5346T1195.002T1059.007T1082T1105T1071.001
- ts-webplug@3.0.5 LWA-2026-5341T1059.007T1105T1071.001T1059
- ttest3333@1.0.0 LWA-2026-5343T1195.002T1071.001
- ttest333@1.0.0 LWA-2026-5342T1195.002
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.