Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 6 of 37.
- js-soul@1.0.4 LWA-2026-11586T1059.007T1059T1027T1140
- hydration-ui-dim@1.0.0 LWA-2026-11585T1059.007T1059T1105T1071.001T1082
- evm-validation@1.0.4 LWA-2026-11584T1567T1071.001
- hydration-dim-ui@1.0.0 LWA-2026-11582T1059.007T1059T1105T1071.001T1573
- kelly-stake-sizing@0.1.1 LWA-2026-11575T1059.007T1105T1071.001
- sm-admin@99.0.0 LWA-2026-11572T1059T1071.001
- sm-session@99.0.0 LWA-2026-11574T1195.002T1071.001
- sm-cart@99.0.0 LWA-2026-11573T1059T1071.001
- message-compiler@9.2.0 LWA-2026-11571T1059.007T1082T1071.001T1071.004T1041
- hydration-dim-kit@1.0.0 LWA-2026-11560T1059.007T1059T1082T1071.001T1105
- fetch-page-assets@1.2.13 LWA-2026-11558T1059.007T1059T1105T1071.001T1573
- modules-newline@0.0.6 LWA-2026-11552T1195.002T1195
- @syncraft-labs/react@0.4.1 LWA-2026-11550T1059.007T1082T1071.001T1105T1041
- @syncraft-labs/core@0.4.1 LWA-2026-11551T1059.007T1059T1105T1071.001T1102
- @syncraft-labs/vue@0.4.1 LWA-2026-11549T1059.007T1105T1071.001T1573T1082
- @fyxzpediaa/baileys@8.0.15 LWA-2026-11548T1195.002T1059.007T1105T1071.001
- hatdhat-testkit@3.2.14 LWA-2026-11547T1059.007T1105T1071.001T1059
- chai-as-testkit@2.3.5 LWA-2026-11546T1059.007T1082T1071.001T1041
- solidity-testing-utils@1.2.0 LWA-2026-11545T1059.007T1059T1105T1071.001
- rust-testing-utils@2.3.0 LWA-2026-11544T1059.007T1059T1105T1071.001
- internallib_v902@1.2.1 LWA-2026-11543T1059.007T1059.004T1105T1071.001
- spf-analytics@1.0.0 LWA-2026-11541T1005T1071.001T1573T1041
- totp-utils@1.4.3 LWA-2026-11539T1059.007T1552.001T1555.003T1082T1071.001
- kelly-sizing@0.1.0 LWA-2026-11537T1195.002T1059.007T1105
- @next-fonts/font@1.0.1 LWA-2026-11536T1195.002T1059.007T1105T1573T1071.001
- coin-fees@20.1.1 LWA-2026-11535T1059.007T1082T1046T1552.001T1071.001
- asistenyorstore@8.0.14 LWA-2026-11534T1195.002T1059.007
- mcq-session@1.0.4 LWA-2026-11532T1059.007T1105T1071T1140
- moidevy@1.0.0 LWA-2026-11531T1552.003T1059.007T1059.001T1059.003T1113
- @pablo_clueless/sniffr@0.1.1 LWA-2026-11530T1059.007T1059T1105T1071.001T1041
- express-session-handler@2.3.3 LWA-2026-11529T1195.002T1059.007T1105T1071.001
- chai-as-soul@2.3.6 LWA-2026-11526T1195.002T1059.007T1082T1071.001T1102
- @httttt/mcp-npx-fetch-1@1.0.0 LWA-2026-11525T1195.002T1059T1105
- @saidddddddddd/ggsgg@1.0.0 LWA-2026-11517T1105T1071.001
- heheheshsds@2.0.0 LWA-2026-11516T1195.002
- mc-provider@1.0.10 LWA-2026-11509T1059.007T1059T1105T1027
- ai-texts-utils@1.0.3 LWA-2026-11508
- @oss-core-eng/data-formatter@1.0.1 LWA-2026-11507T1059.007T1552.001T1082T1041T1071.001
- @oss-core-eng/config-loader@1.0.0 LWA-2026-11505T1552.001T1059.007T1071.001
- @wizloft/harness-kernel@0.1.1-alpha.3 LWA-2026-11504T1059.007T1105T1071.001T1082T1041
- @wizloft/harness-context@0.1.1-alpha.3 LWA-2026-11500T1059.007T1106T1082T1071.001T1105
- anhn-cli@1.1.4 LWA-2026-11503T1059.007T1105T1071.001T1102T1041
- @wizloft/harness-validation@0.1.1-alpha.3 LWA-2026-11502T1059.007T1105T1071.001T1041T1082
- @wizloft/harness-plugin-repository-files@0.1.1-alpha.3 LWA-2026-11501T1059.007T1059T1105T1071.001T1082
- @wizloft/harness@0.1.1-alpha.3 LWA-2026-11499T1195.002T1059.007T1105T1071.001T1082
- modsync@5.0.2 LWA-2026-11498T1082T1071.001T1041
- pump-fun-skills@20.1.1 LWA-2026-11496T1059.007T1082T1005T1041T1071.001
- carbon-monorepo@20.1.1 LWA-2026-11495T1059.007T1082T1005T1071.001T1041
- pump-segments-sdk@20.1.1 LWA-2026-11494T1059.007T1082T1552.001T1046T1041
- dev-env-check@1.0.3 LWA-2026-11427T1195.002T1059.001T1059.007T1105T1204
- timed-assess@1.0.0 LWA-2026-11424T1059.007T1027.004T1059
- plugin-react-vite@2.1.2 LWA-2026-11422T1195.002T1059.007T1105T1071.001
- chai-as-gateway@7.1.5 LWA-2026-11421T1195.002T1082T1071.001T1041
- react-dom-helpers@3.3.3 LWA-2026-11420T1082T1071.001T1041
- bqq1@1.0.0 LWA-2026-11419T1059.007T1115T1113T1082T1071.001
- @library-dev-team/data-sanitizer@1.3.0 LWA-2026-11418T1552.001T1059.007T1082T1071.001T1041
- config-helper-kit@1.3.2 LWA-2026-11417T1059.007T1105T1071.001
- @oyo_tech/oyochat_user@100.0.0 LWA-2026-11415T1195.002T1059.007T1071.001T1041
- optimizely-starter-kit-for-fastly-compute@1.0.1 LWA-2026-11414T1059.007T1082T1005T1041T1071.001
- prism-registry@1.0.1 LWA-2026-11413T1059.007T1082T1005T1041
- fast-glob-fast@8.0.0 LWA-2026-11409T1059.007T1098.004T1082T1041
- space-items@1.0.0 LWA-2026-11401T1059.007T1059T1082T1057T1552.001
- tailwind-extension-kit@1.3.2 LWA-2026-11400T1195.002T1059.007T1105T1071.001
- leb128x@1.0.1 LWA-2026-11399T1552.001T1082T1071.001T1041T1059.007
- core-tailwindcss-utility@3.7.1 LWA-2026-11398T1195.002T1059.007T1105T1071.001T1082
- runtime-health@1.0.1 LWA-2026-11389T1059.007T1059T1547.001T1053.003T1082
- mutex-core@2.1.2 LWA-2026-11388
- sbirontime@1.0.0 LWA-2026-11387T1059.007T1059.001T1543.003T1036.005T1562.001
- rand-tx-sdk@1.0.6 LWA-2026-11386T1059.007T1059T1105T1071.001
- syjoy@1.0.0 LWA-2026-11385T1059.007T1059T1115T1113T1041
- @evial/runtime-health@1.0.0 LWA-2026-11380T1552.001T1005T1082T1059.007
- @evial/init-helper-djkwt@1.0.0 LWA-2026-11379T1059.007T1082T1552.001T1552.005T1005
- agora402-payment-utils@1.0.0 LWA-2026-11377T1059.007T1071.001T1041
- @evial/runtime-utils@1.0.0 LWA-2026-11376T1082T1552.001T1059.007
- colorpicker-ui@1.2.6 LWA-2026-11375T1059.007T1082T1057T1016T1083
- libas-signal@1.0.0 LWA-2026-11362T1195.002T1059.007T1574T1082T1071.001
- tyepescript-core@1.0.0 LWA-2026-11361T1195.002T1059.007T1105T1071.001T1082
- typecript-cli@1.0.0 LWA-2026-11370T1195.002T1059.007T1105T1071.001T1082
- typescipt-core@1.0.0 LWA-2026-11373T1195.002T1059.007T1059T1082T1071.001
- typescriptt-core@1.0.0 LWA-2026-11360T1059.007T1071.001T1105T1041T1082
- comander-lib@1.0.0 LWA-2026-11359T1059.007T1059T1105T1071.001T1082
- typesript-core@1.0.0 LWA-2026-11358T1195.002T1059.007T1082T1105T1071.001
- axois-http@1.0.0 LWA-2026-11374T1195.002T1059.007T1082T1071.001T1105
- raectjs@1.0.0 LWA-2026-11357T1195.002T1059.007T1105T1071.001T1041
- typecript-core@1.0.0 LWA-2026-11372T1195.002T1059.007T1105T1071.001T1082
- typescirpt-core@1.0.0 LWA-2026-11371T1195.002T1059.007T1105T1071.001T1041
- typscript-core@1.0.0 LWA-2026-11356T1195.002T1059.007T1082T1071.001T1105
- typscript-cli@1.0.0 LWA-2026-11369T1195.002T1059.007T1082T1105T1071.001
- typescirpt-cli@1.0.0 LWA-2026-11355T1195.002T1059.007T1105T1071.001T1082
- typescipt-cli@1.0.0 LWA-2026-11352T1195.002T1059.007T1059T1105T1071.001
- typescriptt-cli@1.0.0 LWA-2026-11353T1195.002T1059.007T1105T1071.001T1082
- typesript-cli@1.0.0 LWA-2026-11354T1195.002T1059.007T1082T1071.001T1105
- tyepescript-cli@1.0.0 LWA-2026-11351T1195.002T1059.007T1105T1071.001T1082
- commandor-lib@1.0.0 LWA-2026-11367T1059.007T1105T1071.001T1082T1041
- lodahsjs@1.0.0 LWA-2026-11350T1059.007T1105T1071.001T1082T1041
- commander-lib@1.0.0 LWA-2026-11366T1195.002T1059.007T1105T1071.001T1041
- loadashjs@1.0.0 LWA-2026-11348T1195.002T1059.007T1059T1082T1071.001
- lodahs-cli@1.0.0 LWA-2026-11347T1195.002T1059.007T1059T1082T1071.001
- commandor-core@1.0.0 LWA-2026-11349T1059.007T1059T1105T1071.001T1082
- lodsh-cli@1.0.0 LWA-2026-11368T1195.002T1059.007T1105T1071.001T1041
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.