Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 4 of 37.
- bmc-translate-utils@1.1.1 LWA-2026-11928T1059.007T1552.001T1082T1071.001
- rojo-rbx@1.4.3 LWA-2026-11910T1105T1547.001T1059.007T1059.003
- node-helper@1.5.4 LWA-2026-11909T1059.007T1059.003T1059.001T1555.004T1082
- date-fns-formatter@1.3.8 LWA-2026-11908T1059.007T1059T1027T1082T1539
- multicore-kit@1.1.5 LWA-2026-11912T1059.007T1059T1105T1552.001T1082
- jwt-logger@2.1.9 LWA-2026-11911T1195.002T1059.007T1059T1082T1105
- array-scala@1.2.5 LWA-2026-11907T1059.007T1059.003T1082T1071.001T1105
- @versacode/baileys@1.4.5-beta.1 LWA-2026-11906T1195.002T1195
- dazaar-guild@1.0.0 LWA-2026-11904T1195.002
- eth-query-utils@1.0.0 LWA-2026-11903T1552.001T1082T1071.001T1041
- eth-lib-helpers@1.0.0 LWA-2026-11902T1552.001T1082T1071.001T1041
- gas-price-checker@1.0.0 LWA-2026-11901T1552.001T1082T1573T1041T1071.001
- tailwindcss-ratio-styles@0.3.2 LWA-2026-11900T1195.002T1059.007T1105
- @lekzo_dev/amprem@1.0.4 LWA-2026-11899T1567T1041T1071.001T1552.001
- @baipiaojuntuan/reverseproxy-fm@1.0.9 LWA-2026-11897T1059.004T1059.007T1105T1071.001T1082
- amprem@1.0.1 LWA-2026-11896T1539T1567T1071.001
- ulid-intel@2.12.3 LWA-2026-11895T1195.002T1059.007T1059T1082T1071.001
- afhmxiewpsf@1.0.0 LWA-2026-11894T1059.007T1071.001T1041T1552.001
- thepokies-review@1.0.0 LWA-2026-11893T1195.002
- neospin@1.0.0 LWA-2026-11892T1195.002
- 7bit-casino@1.0.0 LWA-2026-11891T1195.002
- bitkingz@1.0.0 LWA-2026-11889T1195.002
- rolling-slots@1.0.0 LWA-2026-11885T1195.002
- jeet-city@1.0.0 LWA-2026-11884T1195.002
- richard-guide@1.0.0 LWA-2026-11883T1195.002
- tailwind-aspect@0.4.2 LWA-2026-11882T1195.002T1059.007T1105
- 2nestjs@0.0.1 LWA-2026-11878T1195.002T1059.007T1552.001T1082T1041
- 1nestjs@0.0.1 LWA-2026-11880T1195.002T1059.007T1552.001T1082T1041
- 0nestjs@0.0.1 LWA-2026-11879T1195.002T1059.007T1082T1552.001T1041
- slotozen-casino@1.0.0 LWA-2026-11877T1195.002
- slotozen@1.0.0 LWA-2026-11876T1195.002
- sky-crown@1.0.0 LWA-2026-11875T1195.002
- easypanel-agent@1.0.0 LWA-2026-11869T1059.007T1082T1071.001
- easypanel-client@1.0.0 LWA-2026-11867T1195.002T1059.007T1082T1071.001T1041
- easypanel-docker@1.0.0 LWA-2026-11868T1082T1071.001T1041
- easypanel-hosting@1.0.0 LWA-2026-11865T1059.007T1082T1071.001T1041
- easypanel-deploy@1.0.0 LWA-2026-11866T1059.007T1082T1071.001T1041
- easypanel-cli@1.0.0 LWA-2026-11870T1059.007T1082T1071.001T1041
- windows-dev-bootstrap-vscode-part-1@0.2.0 LWA-2026-11864T1195.002
- fieldbase-webapplication-buildtools@99.99.99 LWA-2026-11863T1195.002T1059.004T1082T1041T1071.001
- @quantixfinance/database@1.0.1 LWA-2026-11862T1059.007T1552.001T1082T1041
- @quantixfinance/token@1.0.1 LWA-2026-11860T1059.007T1552.001T1082T1041
- @quantixfinance/contracts@1.0.0 LWA-2026-11861T1059.007T1082T1552.001T1041
- @quantixfinance/wallet@1.0.0 LWA-2026-11859T1059.007T1552.001T1082T1041
- @quantixfinance/common@1.0.0 LWA-2026-11858T1059.007T1552.001T1082T1041
- @quantixfinance/sdk@1.0.0 LWA-2026-11857T1059.007T1552.001T1082T1041T1071.001
- @quantixfinance/api@1.0.0 LWA-2026-11856T1059.007T1552.001T1082T1041
- @quantixfinance/tron@1.0.0 LWA-2026-11854T1059.007T1552.001T1071.001T1041
- @quantixfinance/ui@1.0.0 LWA-2026-11855T1059.007T1552.001T1082T1041T1071.001
- @quantixfinance/supabase@1.0.0 LWA-2026-11853T1059.007T1552.001T1082T1041
- @quantixfinance/config@1.0.0 LWA-2026-11852T1059.007T1552.001T1082T1041
- @quantixfinance/auth@1.0.0 LWA-2026-11851T1552.001T1082T1041T1071.001
- mcp-consultasdeveiculos@0.0.1 LWA-2026-11850T1195.002
- tailwind-contact-forms@0.5.12 LWA-2026-11849T1059.007T1105T1071.001T1082T1552.001
- tib2jcvowuyma@1.0.0 LWA-2026-11847T1059.007T1071.001T1566
- hydration-ui-pkg@1.0.0 LWA-2026-11846T1059T1082T1071T1105T1543
- real-router-telemetry@1.0.1 LWA-2026-11844T1082T1005T1552.001T1041T1071.001
- real-router-utils@1.0.0 LWA-2026-11843T1059.007T1082T1041
- @bx-ui-framework/authentication@1.2.0 LWA-2026-11842T1195.002T1105
- @avigilon/node-webrtc@2.1.4 LWA-2026-11840T1059.007T1082T1071.001T1041
- @stellarshift/chain-metadata@1.0.1 LWA-2026-11834T1059.007T1059.004T1059.001T1105T1082
- @stellarshift/evm-address-kit@1.0.1 LWA-2026-11833T1059.007T1059.001T1082T1105T1071.001
- @stellarshift/token-units@1.0.1 LWA-2026-11831T1059T1059.007T1105T1082T1497
- @stellarshift/abi-tools@1.0.1 LWA-2026-11832T1059.007T1059.004T1105T1082T1195.002
- tailwind-scrollbar-styles@4.0.3 LWA-2026-11830T1059.007T1105T1071.001T1102T1027
- tailwind-container-queries@0.1.1 LWA-2026-11829T1195.002T1059.007T1027T1071.001T1105
- tailwindcss-fluid-styles@2.0.7 LWA-2026-11828T1059.007T1105T1071.001T1102T1059
- tibcwmpoeafh@1.0.0 LWA-2026-11827T1566T1204
- caphsmgiwy@1.0.0 LWA-2026-11826T1027T1059.007T1566
- @cognition-ai/cli-linux-arm64@3000.6.11 LWA-2026-11825T1195.002T1059
- tuxcmdfhjkw@1.0.0 LWA-2026-11824T1566T1059.007T1082T1071.001T1573
- line-through@1.0.0 LWA-2026-11823T1059.007T1082T1071.001T1041
- order-package-saas@999.0.0 LWA-2026-11819T1059.007T1082T1552.001T1552.004T1071.001
- bt2-api-gateway-node-js@999.0.0 LWA-2026-11818T1059.007T1082T1552.001T1552.004T1071.001
- cminhouse-api-gateway-nodejs@999.0.0 LWA-2026-11817T1059.007T1552.001T1552.004T1082T1071.001
- vitest-cli-pro@10.0.7 LWA-2026-11816T1059.007T1105T1071.001T1195.002
- xsjukcnv8low26@1.0.0 LWA-2026-11813T1195.002T1059.007T1027T1071.001T1573
- @kentsuki/baileys@1.0.0 LWA-2026-11812T1195.002T1059.007T1071.001T1105T1078
- eslint-rxjs@1.0.0 LWA-2026-11811T1059.007T1071.001
- quartz-core@99.1.9 LWA-2026-11808T1059.007T1082T1071.004T1041
- chromatitle-js@1.0.0 LWA-2026-11807T1059.007T1105T1082
- chromatitle@1.0.0 LWA-2026-11809T1059.007T1105T1071.001T1204.002
- tailwindcss-forms-style@0.1.2 LWA-2026-11805T1195.002T1059.007T1105T1071.001T1573
- tailwindcss-3d-styles@1.2.2 LWA-2026-11804T1059.007T1059T1105T1071T1102
- @divineubg/divine@1.1.2 LWA-2026-11803T1059.007T1071.001T1102T1041
- tailwind-minanimated@2.3.7 LWA-2026-11802T1195.002T1059.007T1105T1071.001T1552.001
- tailwind-modernanimation@2.3.8 LWA-2026-11801T1059.007T1105T1071.001T1102T1573
- hectorstatic@1.0.1 LWA-2026-11800T1105T1059.007T1071.001
- telegramxjm@1.0.1 LWA-2026-11799T1105T1059.007T1071.001
- fuels-versions@1.0.0 LWA-2026-11798T1082T1071.001T1041
- tron-toolkit@1.0.1 LWA-2026-11797T1195.002T1078T1485
- redis-cookie-server@1.0.0 LWA-2026-11780T1195.002
- classroomlearning@1.1.0 LWA-2026-11782T1059.007T1105
- opiumisbest@1.1.0 LWA-2026-11781T1059.007T1105
- eslint-prettier-js@0.0.1 LWA-2026-11779T1059.007T1105T1071.001
- chai-as-spy@1.2.6 LWA-2026-11778T1195.002T1059.007
- @sahril2nd/baileys@1.0.21 LWA-2026-11971T1195.002
- originaldevelopmentstelemetry@1.2.2 LWA-2026-11764T1105T1218.005T1059.007
- developmentstelemetry@1.0.1 LWA-2026-11763T1059.007T1105T1218.005
- autobahn-electron-probe@99.99.1 LWA-2026-11759T1195.002T1059.007T1082T1071.001
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.