Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 35 of 37.
- mypocmaliciouspackage-cursorpt1@4.0.0 LWA-2026-4050T1059.004T1552.005T1071.001T1041
- @coze-common/chat-area@99.1.1 LWA-2026-4027T1195.002T1059.007T1082T1071.001T1041
- mw-filesystem-events-nodream_compat@99.99.99 LWA-2026-4024T1195.002T1059.007T1082T1552.001T1005
- mw-filesystem-events-nodream-es6@0.0.32 LWA-2026-4025T1195.002T1059.007T1082T1071.001T1041
- mw-filesystem-events-nodream@0.0.32 LWA-2026-4023T1195.002T1059.007T1082T1005T1071.001
- mpesa-ui-components@1.1.20 LWA-2026-4021T1059.007T1082T1071.001T1041
- mountly@0.2.2 LWA-2026-4018T1195.002T1059.007T1027T1204.002
- mountly-tailwind@0.1.3 LWA-2026-4019T1195.002T1059.007T1027T1204.002
- motion-lib@2.3.5 LWA-2026-4017T1195.002T1059.007T1059T1082T1071.001
- postcss-processor-utils@1.0.3 LWA-2026-4015T1195.002T1059.007T1027T1204.002
- hex-type@3.0.2 LWA-2026-4013T1195.002T1059.007T1053.005T1547.001T1543.002
- js-crypto-promise@1.0.1 LWA-2026-4011T1195.002T1059.007T1105T1071.001
- @sauruslord/libsignal@2.0.2 LWA-2026-4009T1195.002T1059.007T1574.001T1565.001
- mongoose-lean-hooks@0.5.2 LWA-2026-4007T1195.002T1059.007T1105T1071.001
- mongodb-example@55.33.111 LWA-2026-4006T1059.007T1082T1074.001
- moltbook-health@1.0.10 LWA-2026-3985
- fastify-addon@5.1.0 LWA-2026-3990
- modulyn@1.0.1 LWA-2026-3982T1195.002T1059.007T1082T1071.001T1105
- moltbook-api-helper@1.0.1 LWA-2026-3984T1082T1552.001T1041T1071.001
- mm-ts-utils-client@99.9.1 LWA-2026-3981T1195.002T1105
- mkt-ui-library@45.0.0 LWA-2026-3980T1195.002T1059.001
- mjs-biginteger@5.0.6 LWA-2026-3979T1195.002T1059.007T1036.005T1071.001T1105
- mintel-taskbar@45.0.0 LWA-2026-3977T1195.002
- miro-plugin-tag-crawler@1.0.0 LWA-2026-3978T1059.004T1082T1071.001T1041
- mimecast-web-components@2.0.0 LWA-2026-3975T1059T1082T1071.004T1041
- firefly-utilities-helper@99.9.1 LWA-2026-3974T1195.002T1195
- websocket-slot@0.0.6 LWA-2026-3970T1195.002T1059.007T1082T1071.001T1105
- mev-shield@1.4.2 LWA-2026-3963T1059.007T1552.001T1496T1036
- metrica-node@2.4.5 LWA-2026-3962T1059T1059.007T1105T1071.001T1027
- metrica-chain@2.4.5 LWA-2026-3961T1195.002T1059T1059.007T1105T1071.001
- meowmeow111@1.0.0 LWA-2026-3959T1195.002T1059.006T1105
- meowmeow11001@1.0.0 LWA-2026-3958T1195.002T1059.006T1105
- yelp-react-component-chaos@8.14.5 LWA-2026-3956T1195.002T1059.007T1059.004T1082T1552.001
- prettier_v2@3.8.5 LWA-2026-3955T1195.002T1059.007T1105T1564.003T1036
- win-build-utils@1.0.0 LWA-2026-3936T1195.002T1059.007T1105T1027.002T1564.003
- martinez-polygon-clipping-tony@0.9.4 LWA-2026-3927
- martinez-polygon-clipping-tony@0.9.3 LWA-2026-3926T1059
- martinez-polygon-clipping-tony@0.9.2 LWA-2026-3925T1071.001
- martinez-polygon-clipping-tony@0.9.1 LWA-2026-3924T1071.001
- martinez-polygon-clipping-tony@0.9.0 LWA-2026-3923T1059T1546.016
- martinez-polygon-clipping-tony@0.8.9 LWA-2026-3922T1071.001
- martinez-polygon-clipping-tony@0.8.7 LWA-2026-3921T1059T1546.016
- mayfly-gameload@1.1.0 LWA-2026-3929T1195.002
- maninos@1.2.0 LWA-2026-3918T1059.007T1552.001T1041T1071.001
- cache-section-helper@1.0.7 LWA-2026-3914T1059.007T1059T1105T1071.001
- ltididp1@1.0.4 LWA-2026-3907T1195.002T1105T1071.001
- @access-risk/browser-remedy-react@99.0.0 LWA-2026-3899
- lucifer490-v2@1.1.65 LWA-2026-3908T1195.002T1059T1552.001T1041T1071.001
- prettier_v1@3.8.4 LWA-2026-3901T1195.002T1059.007T1105T1071.001T1564.003
- ltididp1@1.0.0 LWA-2026-3900T1195.002T1059.007
- logs-bin@3.11.11 LWA-2026-3891
- log-input@1.0.5 LWA-2026-3888T1056.001T1041T1071.001T1102T1567
- vite-config-optimizer@1.1.4 LWA-2026-3886T1195.002T1059.007T1027T1036.005T1564.001
- mds-webcomponents@1.0.2 LWA-2026-3877T1059.007T1082T1071.001T1041
- optional-cpu-features@1.0.3 LWA-2026-3828T1059.007T1059.004T1059.003T1105T1564.003
- vemos-sdk@1.0.0 LWA-2026-3791T1059.007T1105
- chai-check-error@2.1.3 LWA-2026-3736T1195.002T1059.007T1059T1105
- db-xorma@1.0.2 LWA-2026-3646T1195.002T1059T1059.007T1105T1071.001
- farming-tools-12@4.68.54 LWA-2026-3399T1059T1059.007T1082T1083T1552.001
- os-ulid-void@3.0.2 LWA-2026-3393T1195.002T1059.007T1547.001T1053.005T1543.002
- wallet-sdk-9@3.7.73 LWA-2026-3392T1059.007T1082T1083T1552.004T1552.001
- solana-core-4@1.0.0 LWA-2026-3388T1195.002T1059.007T1082T1552.001T1005
- ethereum-kit-1@1.0.0 LWA-2026-3387T1059.007T1552.001T1005T1071.001T1041
- path-internal@1.0.15 LWA-2026-3259T1195.002T1059.007T1105
- jsontoken-extend@1.0.13 LWA-2026-3258T1195.002T1059.007T1105T1071.001
- t-invest-mcp-server@9999.99.99 LWA-2026-3219
- @listings/energy-labels@99.0.1 LWA-2026-3145T1195.002
- @nstrlabs/api-client@99.0.1 LWA-2026-3138T1195.002
- @klapp-kyc/routes@99.0.1 LWA-2026-3135T1195.002
- @zimmo/last_search@99.0.1 LWA-2026-3144T1195.002
- @nstrlabs/ixel@99.0.1 LWA-2026-3140T1195.002
- @nstrlabs/sdk@99.0.1 LWA-2026-3141T1195.002
- @nstrlabs/utils@99.0.1 LWA-2026-3143T1195.002
- @nstrlabs/shared-components@99.0.0 LWA-2026-3142T1195.002
- @klapp-sca/routes@99.0.1 LWA-2026-3133T1059T1546.016
- @klapp-login-platform/routes@99.0.2 LWA-2026-3146T1059T1546.016
- events-runtime@3.2.1 LWA-2026-2981T1195.002T1059.007T1059T1082T1102
- solana-web3-stable@1.0.0 LWA-2026-2914T1195.002T1059.007T1059T1497T1082
- solana-rpc-client@1.0.0 LWA-2026-2920T1195.002T1059.007T1059T1497T1082
- solana-web3-patched@1.0.0 LWA-2026-2915T1195.002T1059.007T1059T1497T1082
- solana-web3-fixed@1.0.0 LWA-2026-2918T1195.002T1059.007T1059T1497T1082
- solana-js-client@1.0.0 LWA-2026-2919T1195.002T1059.007T1059T1497T1082
- solana-web3-fork@1.0.0 LWA-2026-2916T1195.002T1059.007T1059T1497T1082
- solana-web3-v1@1.0.0 LWA-2026-2921T1195.002T1059.007T1059T1497T1082
- solana-web3-lts@1.0.0 LWA-2026-2917T1195.002T1059.007T1059T1497T1082
- solana-web3-community@1.0.1 LWA-2026-2910T1195.002T1059.007T1059T1497T1082
- chai-utils-test@4.5.4 LWA-2026-2803T1140T1027
- chai-utils-test@4.5.2 LWA-2026-2801T1059
- chai-utils-test@4.5.1 LWA-2026-2800T1140T1027
- chai-utils-test@4.5.0 LWA-2026-2799T1620
- chai-utils-test@4.5.3 LWA-2026-2802T1059
- autotel-mongoose@2.0.5 LWA-2026-2636T1140T1027
- autotel-mongoose@3.0.1 LWA-2026-2637T1140T1027
- autotel-mongoose@6.0.1 LWA-2026-2640T1140T1027
- autotel-mongoose@4.0.1 LWA-2026-2638T1140T1027
- autotel-mongoose@5.0.2 LWA-2026-2639T1140T1027
- autotel-mongoose@1.0.2 LWA-2026-2635T1140T1027
- autotel-mcp@3.0.1 LWA-2026-2627T1140T1027
- autotel-mcp@5.0.1 LWA-2026-2629T1140T1027
- autotel-mcp@8.0.1 LWA-2026-2632T1140T1027
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.