Confirmed malicious npm packages

Every package version the probe has confirmed malicious and published, newest first. 2,833 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. Page 5 of 29.

  1. bigops-operator-status@35.4.5 LWA-2026-10315
    T1059.007T1059T1105T1071.001T1102
  2. dolyame-ui-pie@35.5.3 LWA-2026-10316
    T1059.007T1105T1071.001T1102T1082
  3. bigops-offers@35.6.8 LWA-2026-10309
    T1059T1105T1071.001T1102T1082
  4. dolyame-ui-menu@35.6.1 LWA-2026-10312
    T1059.007T1059T1105T1071.001T1102
  5. T1059.007T1059T1105T1071.001T1102
  6. dolyame-ui-loader@35.1.5 LWA-2026-10313
    T1059.007T1105T1071.001T1102T1036
  7. dlab_workshop@1.0.3 LWA-2026-10307
    T1059.007T1082T1552.001T1041
  8. eacq-auth@35.4.8 LWA-2026-10310
    T1059.007T1105T1071.001T1102T1059
  9. dp-owners@35.2.6 LWA-2026-10311
    T1059.007T1059T1105T1071.001T1102
  10. dolyame-ui-scroll@35.4.3 LWA-2026-10306
    T1195.002T1059.007T1059T1105T1071.001
  11. eacq-acq-menu-core@35.9.7 LWA-2026-10296
    T1059T1059.007T1105T1071.001T1102
  12. dws-frontend-dws-frontend-core@35.4.3 LWA-2026-10298
    T1059T1105T1071.001T1102T1082
  13. dolyame-ui-text@35.7.4 LWA-2026-10302
    T1059.007T1105T1071.001T1102T1082
  14. bigops-insite@35.8.1 LWA-2026-10294
    T1059.007T1105T1071.001T1082T1059
  15. beaver-ui-popover-card@35.4.4 LWA-2026-10295
    T1059.007T1105T1071.001T1102T1567
  16. dp-web-header@35.3.8 LWA-2026-10299
    T1059.007T1105T1071.001T1102T1059
  17. bigops-legacy-telephony-panel@35.5.7 LWA-2026-10293
    T1059.007T1059T1105T1071.001T1102
  18. dolyame-ui-toggle@35.4.1 LWA-2026-10300
    T1195.002T1059.007T1059T1082T1105
  19. dolyame-ui-textarea@35.3.4 LWA-2026-10301
    T1059.007T1105T1071.001T1102T1059
  20. dwsai-dwsai-core@35.8.4 LWA-2026-10297
    T1105T1059.007T1071.001T1102T1059
  21. dolyame-ui-table@35.5.4 LWA-2026-10304
    T1059T1059.007T1105T1071.001T1102
  22. dolyame-ui-tag@35.9.9 LWA-2026-10303
    T1195.002T1059.007T1105T1071.001T1102
  23. dolyame-ui-swiper@35.7.7 LWA-2026-10305
    T1059T1059.007T1105T1071.001T1102
  24. dolyame-ui-themes@35.6.3 LWA-2026-10292
    T1059.007T1105T1071.001T1102T1082
  25. dolyame-ui-tooltip@35.8.8 LWA-2026-10291
    T1195.002T1059.007T1105T1071.001T1071.004
  26. eacq-acq-menu@35.2.1 LWA-2026-10289
    T1059.007T1105T1071.001T1102T1059
  27. dolyame-ui-types@35.8.2 LWA-2026-10290
    T1195.002T1059.007T1105T1071.001T1071.004
  28. devplatform-po-transformer@35.1.8 LWA-2026-10287
    T1059T1059.007T1105T1071.001T1071.004
  29. devplatform-jscodeshift-utils@35.3.8 LWA-2026-10286
    T1059.007T1105T1071.001T1102T1082
  30. devplatform-api-v2-resource-mock@35.4.1 LWA-2026-10288
    T1059.007T1105T1071.001T1102T1059
  31. devplatform-react-form@35.8.3 LWA-2026-10285
    T1059.007T1059T1105T1071.001T1102
  32. devplatform-po-loader@35.1.8 LWA-2026-10284
    T1059.007T1105T1071.001T1102T1059
  33. devplatform-spa-ui@35.8.2 LWA-2026-10283
    T1059.007T1059T1105T1071.001T1071.004
  34. devplatform-spa-plugin-devtools@35.5.6 LWA-2026-10280
    T1059.007T1105T1071.001T1102T1059
  35. T1059.007T1105T1071.001T1102.001T1564.001
  36. devplatform-api-v2-resources@35.3.8 LWA-2026-10278
    T1059.007T1105T1071.001T1102T1082
  37. devplatform-ui-notification@35.3.6 LWA-2026-10281
    T1059.007T1105T1071.001T1102T1059
  38. T1059T1059.007T1105T1071T1071.001
  39. T1059.007T1059T1105T1071.001T1102
  40. devplatform-npm-versions-checker@35.5.9 LWA-2026-10276
    T1059T1059.007T1105T1071.001T1102
  41. delivery-ci-storybook@35.5.8 LWA-2026-10275
    T1105T1071.001T1102T1059.007T1059
  42. devplatform-spa-plugin-sentry@35.1.1 LWA-2026-10274
    T1059.007T1105T1071.001T1102T1082
  43. T1059.007T1105T1071.001T1102T1082
  44. T1059.007T1059T1105T1071.001T1102
  45. devplatform-spa-di@35.5.8 LWA-2026-10272
    T1059T1059.007T1105T1071.001T1102
  46. dolyame-ui-footer@35.5.8 LWA-2026-10269
    T1195.002T1059.007T1059T1105T1071.001
  47. T1059.007T1105T1071.001T1102T1082
  48. devplatform-vite-plugin-gle@35.3.9 LWA-2026-10267
    T1059.007T1059T1105T1071.001T1102
  49. devplatform-s3-uploader@35.4.4 LWA-2026-10270
    T1059.007T1059T1105T1071.001T1102
  50. devplatform-spa-plugin-s3@35.5.9 LWA-2026-10266
    T1059.007T1059T1105T1071.001T1102
  51. T1059T1105T1071.001T1102T1082
  52. dolyame-boxy-atom-icon-loader@35.1.8 LWA-2026-10264
    T1059.007T1105T1071.001T1102T1082
  53. devplatform-table@35.7.6 LWA-2026-10262
    T1195.002T1059.007T1105T1071.001T1102
  54. devplatform-spa-plugin-location@35.9.2 LWA-2026-10261
    T1059.007T1059.003T1105T1071.001T1102.002
  55. T1059.007T1105T1071.001T1102T1059
  56. devplatform-select-user@35.4.4 LWA-2026-10260
    T1059T1059.007T1105T1071.001T1102
  57. T1105T1059T1071T1102T1059.007
  58. devplatform-select-fields@35.2.6 LWA-2026-10258
    T1059.007T1105T1071.001T1102T1568
  59. devplatform-s3-client@35.9.5 LWA-2026-10257
    T1059.007T1105T1071.001T1102T1082
  60. devplatform-snarkdown@35.2.1 LWA-2026-10256
    T1195.002T1059.007T1105T1071.001T1071.004
  61. devplatform-nx-husky@35.7.7 LWA-2026-10255
    T1059.007T1105T1071.001T1102T1567
  62. devplatform-spa-route-tree@35.1.3 LWA-2026-10254
    T1059T1059.007T1105T1071.001T1102
  63. devplatform-prettier-config@35.1.3 LWA-2026-10253
    T1059.007T1105T1071.001T1102T1568.002
  64. T1059.007T1105T1071.001T1071.004T1059
  65. T1059.007T1105T1071.001T1102T1568.002
  66. dolyame-boxy-atom-bnpl-popup@35.9.3 LWA-2026-10250
    T1059.007T1105T1071.001T1102T1071.004
  67. devplatform-spa-devtools@35.2.6 LWA-2026-10251
    T1059T1059.007T1105T1071.001T1071
  68. devplatform-cra-template@35.6.2 LWA-2026-10248
    T1059.007T1059T1105T1071.001T1102
  69. dolyame-boxy-block@35.5.2 LWA-2026-10247
    T1195.002T1059T1059.007T1105T1071.001
  70. devplatform-react-micro-frontend@35.2.1 LWA-2026-10246
    T1059.007T1059T1105T1071.001T1102
  71. dlp-dlp-core@35.1.3 LWA-2026-10242
    T1059.007T1105T1071.001T1102T1059
  72. dippy-invertor@35.1.6 LWA-2026-10245
    T1059.007T1105T1071.001T1071.004T1059
  73. dolyame-ui-grid@35.7.4 LWA-2026-10243
    T1059T1105T1071.001T1048T1082
  74. T1059.007T1059.004T1105T1071.001T1102
  75. dolyame-ui-container@35.3.7 LWA-2026-10241
    T1195.002T1059.007T1105T1071.001T1102
  76. devplatform-vite-plugin-external@35.3.6 LWA-2026-10240
    T1059.007T1105T1071.001T1102T1059
  77. devplatform-cli@35.7.4 LWA-2026-10238
    T1059.007T1105T1071.001T1102T1059
  78. T1059.007T1105T1071.001T1102T1082
  79. dolyame-ui-checkable@35.4.1 LWA-2026-10236
    T1195.002T1059T1105T1071.001T1102
  80. devplatform-nx-spa@35.8.7 LWA-2026-10237
    T1059T1059.007T1105T1071.001T1102
  81. devplatform-auth-client@35.2.1 LWA-2026-10234
    T1059.007T1105T1071.001T1048.003T1082
  82. T1059.007T1105T1071.001T1102T1059
  83. devplatform-sdk@35.6.1 LWA-2026-10231
    T1059.007T1059T1105T1071.001T1102
  84. dolyame-ui-draggable@35.4.6 LWA-2026-10230
    T1195.002T1059T1105T1071.001T1102
  85. delivery-ci-unit@35.9.3 LWA-2026-10228
    T1059T1059.007T1105T1071.001T1102
  86. T1059T1105T1071.001T1102T1036
  87. devplatform-i18n@35.6.2 LWA-2026-10227
    T1059.007T1105T1071.001T1102T1071.004
  88. T1059.007T1105T1071.001T1102T1059
  89. devplatform-spa-plugin-history@35.1.4 LWA-2026-10226
    T1059.007T1105T1071.001T1102T1059
  90. T1059.007T1105T1071.001T1071.004T1059
  91. devplatform-nx-react@35.9.4 LWA-2026-10222
    T1059.007T1105T1071.001T1102T1082
  92. dolyame-boxy-atom-container@35.3.2 LWA-2026-10225
    T1059T1105T1071.001T1102T1082
  93. devplatform-react-query-clients@35.7.7 LWA-2026-10223
    T1059T1105T1071.001T1102T1567
  94. T1195.002T1059.007T1105T1071.001T1102
  95. devplatform-data-table@35.4.1 LWA-2026-10219
    T1195.002T1059.007T1105T1071.001T1102
  96. dolyame-boxy-atom-bnpl-badge@35.2.3 LWA-2026-10217
    T1059.007T1105T1071.001T1102T1082
  97. devplatform-zod-wip-api@35.9.3 LWA-2026-10220
    T1059T1059.007T1105T1071.001T1102
  98. devplatform-spa-use-track@35.5.3 LWA-2026-10218
    T1059.007T1105T1071.001T1102T1059
  99. devplatform-create-nx-spa@35.4.9 LWA-2026-10212
    T1059T1059.007T1105T1071.001T1071.004
  100. T1059T1105T1071.001T1567T1082

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.