Leitwacht LEITWACHT Threat Intel

Confirmed malicious npm packages

Every package version with a published advisory, newest first. 3,807 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 39 of 39.

  1. @asavie/i18n@99.0.3 LWA-2026-0074
    T1059T1546.016
  2. wm-mapper@99.9.1 LWA-2026-0073
    T1195.002T1105
  3. @pisell/pisellos@2.2.164 LWA-2026-0033
    T1195.002
  4. @pisell/pisellos@2.2.168 LWA-2026-0034
    T1195.002
  5. @pisell/pisellos@2.2.169 LWA-2026-0035
    T1195.002
  6. @pisell/pisellos@2.2.173 LWA-2026-0036
    T1195.002
  7. forge-jsxy@1.0.91 LWA-2026-0060
    T1059T1546.016

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.