Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 5 of 37.
- com.db.autobahn.notification-center-electron@88.88.1 LWA-2026-11758T1059.007T1082T1041
- discord-mfa-solver@1.0.2 LWA-2026-11757T1195.002T1059.007
- node-net-pool@1.0.0 LWA-2026-11756T1059.007T1027
- node-request-utils@1.0.0 LWA-2026-11755T1059.007T1105T1547.001T1053.005T1562.001
- mfaatest@1.0.0 LWA-2026-11754T1195.002T1059.007T1105T1552.001
- helmify@0.0.1 LWA-2026-11753T1195.002
- night-casino@1.0.0 LWA-2026-11739T1195.002
- simsino-casino@1.0.0 LWA-2026-11741T1195.002
- bdmbet-online@1.0.0 LWA-2026-11740T1195.002
- lunubet-casino@1.0.0 LWA-2026-11733T1195.002
- olympe-casino@1.0.0 LWA-2026-11737T1195.002
- allyspin-casino@1.0.0 LWA-2026-11736T1195.002
- trickz-casino@1.0.0 LWA-2026-11735T1195.002
- onlyspins-casino@1.0.0 LWA-2026-11734T1195.002
- mfafix@1.0.0 LWA-2026-11728T1105T1059.007T1071.001
- cbc97b7a@1.1787999998.0 LWA-2026-11725T1059.004T1496T1489T1070T1105
- test__123q1@2.1.3 LWA-2026-11723T1195.002T1059.007T1082T1552.001T1555
- exprss-helmet@1.0.1 LWA-2026-11722T1195.002T1059.007T1105T1027
- express-helmet@0.0.1 LWA-2026-11721T1195.002
- claude-channel-telegram@9.9.9 LWA-2026-11716T1059.007T1082T1041
- claude-channel-discord@9.9.9 LWA-2026-11715T1059.007T1082T1041
- dsh-tauri-rightclick@0.4.9 LWA-2026-11714T1195.002
- grafeno-payments@1.0.0 LWA-2026-11712T1059.007T1082T1552.001T1071.001T1105
- grafeno-webhook@1.0.0 LWA-2026-11711T1059T1059.007T1552.001T1082T1071
- grafeno-billing@1.0.0 LWA-2026-11710T1059.007T1059.004T1082T1552.001T1041
- spc_login@1.0.0 LWA-2026-11708T1059.007T1552.001T1082T1071.001T1105
- spc-grafeno-login@1.0.0 LWA-2026-11709T1059.007T1552.001T1041T1105T1059.004
- nx-app@9999.0.0-security-test LWA-2026-11702T1195.002T1105
- @berrysdk/transport@0.1.9 LWA-2026-11701T1195.002T1195
- grafeno-auth@1.0.0 LWA-2026-11696T1059.007T1105T1053.003
- grafeno-pix@1.0.0 LWA-2026-11695T1059.007T1105T1053T1071.001
- grafeno-logger@1.0.0 LWA-2026-11694T1059.007T1105T1053.003
- grafeno-config@1.0.0 LWA-2026-11697T1059.007T1105T1053.003T1071.001
- grafeno-core@1.0.0 LWA-2026-11692T1059.007T1059.004T1105T1053.003T1546.004
- grafeno-utils@1.0.0 LWA-2026-11693T1059.007T1105T1053T1071.001
- grafeno-client@1.0.0 LWA-2026-11691T1059.007T1105T1053.003T1071.001
- grafeno-sdk@1.0.0 LWA-2026-11689T1059.007T1105
- spc-grafeno@1.0.0 LWA-2026-11690T1059.007T1105T1053.003T1546.004
- grafeno-api@1.0.0 LWA-2026-11688T1059.007T1105
- grafeno-products-wrapper@999.0.0 LWA-2026-11686T1059T1082T1071.001T1041
- grafeno-products@999.0.0 LWA-2026-11685T1059.007T1082T1071.001T1041
- grafeno-actions@999.0.0 LWA-2026-11684T1059.004T1082T1105T1041
- T1195.002T1059.007T1105
- test-in-one@1.0.0 LWA-2026-11682T1552.001T1555T1082T1005
- mfa-js@1.0.4 LWA-2026-11680T1059.007T1059.003T1547.001T1547.004T1053.005
- cacao1@9.9.9 LWA-2026-11679T1195.002T1059.007T1082T1071.001
- melbet-ivoire@1.0.0 LWA-2026-11678T1195.002
- @bx-ui-framework/common@15.0.0 LWA-2026-11673T1195.002T1105
- @bx-ui-framework/microfrontend@15.0.0 LWA-2026-11890T1195.002T1105
- @hd-team/app-dnpkg-beta@1.0.20260828054000 LWA-2026-11672
- 2fasecretkey@1.1.2 LWA-2026-11671T1059.007T1059.005T1105T1071.001
- manager-thedate@1.0.16 LWA-2026-11669T1195.002
- 2fa-secretkey@1.0.1 LWA-2026-11664T1059.007T1105T1071.001
- discord-mfa@3.0.0 LWA-2026-11663T1059.007T1105T1547.001T1053.005T1564.001
- vitest-chalk-pro@10.0.7 LWA-2026-11662T1059.007T1105T1071.001T1195.002
- shadowmd@8.6.87 LWA-2026-11660T1195.002T1059.007
- hydration-ui-dlx@1.0.0 LWA-2026-11659T1195.002T1059.007T1082T1552.001T1005
- eth-pino@2.0.3 LWA-2026-11658T1195.002T1059.007T1552.001T1082T1071.001
- selfsigned-certificate@1.0.0 LWA-2026-11654T1059.007T1105T1071.001T1552.001
- tailwindcss-form-styles@0.5.15 LWA-2026-11653T1195.002T1059.007T1082T1071.001T1105
- tailwindcss-3d-animate@1.2.2 LWA-2026-11652T1195.002T1059.007T1552.001T1082T1071.001
- htps-provider@1.0.11 LWA-2026-11648T1195.002T1059.007T1105T1027
- @flagship-io/openfeature-provider-js@1.0.0 LWA-2026-11651T1195.002
- dsh-tauri-panel-extension@0.4.0 LWA-2026-11657T1552.001T1082T1059
- js-tokens-array@1.0.0 LWA-2026-11647T1059.007T1105T1071.001
- date-fns-sync@1.0.0 LWA-2026-11646T1195.002T1059.007T1105
- ckeditor5-ckbox@5.0.0 LWA-2026-11645T1059.007T1082T1071.001T1041
- supersignaturenature@1.0.5 LWA-2026-11644T1195.002T1059.007T1105
- external_deps_enjoyer@1.0.0 LWA-2026-11643T1195.002T1105
- octopus-action@1.0.1 LWA-2026-11642T1059.007T1082T1005T1041
- mt-ts-serverless-starter@1.0.1 LWA-2026-11641T1059.007T1082T1041
- zenntechinc-cli@1.6.4 LWA-2026-11639T1059.007T1105T1071.001T1573T1102
- omniauth-recharge-rails-example@1.0.0 LWA-2026-11637T1059T1082T1041
- model-poc-suhail@1.0.12 LWA-2026-11635T1059.007T1059.004T1071.001
- moidevz@1.0.0 LWA-2026-11632T1539T1555.003T1113T1059.007T1562
- hydration-vli-ui@1.0.0 LWA-2026-11628T1059.007T1059T1106T1082T1552.001
- commonjs-code-token@1.0.0 LWA-2026-11618T1059.007T1105T1071.001
- bamru@1.0.0 LWA-2026-11616T1059.007T1059T1115T1113T1041
- chai-plus@6.2.5 LWA-2026-11615T1195.002T1059.007T1105T1071.001
- r4wk-book@2.2.2 LWA-2026-11614T1059.007T1059T1105T1071
- spotify-url-resolvers@3.4.2 LWA-2026-11613T1059.007T1082T1560T1071.001T1567
- tsrml612@1.14.0 LWA-2026-11612T1552.001T1082T1041T1071.001
- chai-as-otc@1.0.5 LWA-2026-11611T1195.002T1059.007T1552.001T1041T1105
- spotify-url-infos@3.4.2 LWA-2026-11610T1059.007T1005T1567T1071.001
- hydration-cls-ui@1.0.0 LWA-2026-11609T1059.007T1059T1082T1552.001T1555.003
- ecobee-api@0.0.2 LWA-2026-11608T1059.007T1082T1071.001T1041
- mham-js@1.0.4 LWA-2026-11607T1059.007T1027T1105
- mastercard-cc-sdk@1.0.0 LWA-2026-11606T1195.002
- pantheon-secrets@1.0.0 LWA-2026-11605T1195.002
- dim-hydration-ui@1.0.0 LWA-2026-11604T1059.007T1059T1105T1071T1082
- dims-hydration-ui@1.0.0 LWA-2026-11603T1059.007T1059T1105T1071.001T1573
- @atfm/utils@99.99.99 LWA-2026-11601T1059.007T1082T1071.001T1041
- @atfm/typeface@99.99.99 LWA-2026-11600T1195.002T1059.007T1082T1071.001T1041
- @elc-online/up-analytics@99.99.99 LWA-2026-11602T1059.007T1082T1071.001T1041
- @atfm/atfm-material-ui@99.99.99 LWA-2026-11599T1059T1082T1071.001T1041
- auth-otp@1.0.5 LWA-2026-11595T1059.007T1552.001T1041T1567T1105
- remove-bg-serverless-azure@1.0.1 LWA-2026-11590T1059.007T1082T1005T1041
- openai-pr-reviewer@1.0.0 LWA-2026-11589T1059.007T1082T1005T1041T1071.001
- dsh-tauri-ui@0.1.0 LWA-2026-11588T1195.002
- chai-as-mno@1.0.5 LWA-2026-11587T1059.007T1071.001T1102T1082
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.