Leitwacht LEITWACHT Threat Intel

Confirmed malicious npm packages

Every package version with a published advisory, newest first. 4,005 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 41 of 41.

  1. @pisell/pisellos@2.2.164 LWA-2026-0033
    T1195.002
  2. @pisell/pisellos@2.2.168 LWA-2026-0034
    T1195.002
  3. @pisell/pisellos@2.2.169 LWA-2026-0035
    T1195.002
  4. @pisell/pisellos@2.2.173 LWA-2026-0036
    T1195.002
  5. forge-jsxy@1.0.91 LWA-2026-0060
    T1059T1546.016

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.