Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 8 of 37.
- ngsw-config@1.0.0 LWA-2026-11084T1059.007T1082T1071.001
- gaarf-node-bq@1.0.0 LWA-2026-11083T1059.007T1082T1071.001
- karma-proxy@1.0.0 LWA-2026-11082T1059.007T1082T1071.001
- github-policy-bot@1.0.0 LWA-2026-11081T1059.007T1082T1071.001
- fmt-util-k7x2@1.0.0 LWA-2026-11079T1059.007T1082T1552.005T1041
- internallib_v392@1.0.3 LWA-2026-11042T1059.007T1071.001T1105
- @siwatfa/yorn@0.0.2 LWA-2026-11428T1071T1552.001T1082
- prediction-trader@2.3.0 LWA-2026-11036T1059.007T1105T1071.001
- @years17/n8n-nodes-helper-utils@1.0.1 LWA-2026-11034T1082T1059.007
- @assetshop/verify-cli@99.0.0 LWA-2026-11032
- verify-cli@99.0.0 LWA-2026-11031
- dzvchorehui2@1.0.0 LWA-2026-11026T1195.002
- external-process-live-log@13.5.2 LWA-2026-11025T1059.007T1105T1071.001
- dzcvhfruwluwe@1.0.0 LWA-2026-11023T1189T1566T1552.001
- kit-map-vim@1.0.0 LWA-2026-11016T1059.007T1059T1105T1071.001T1573
- velora-kit@12.0.2 LWA-2026-11010T1059.007T1105T1071.001T1082
- node-config-svg-contract@1.0.0 LWA-2026-11004T1059.007T1105
- dakumangalsingh@1.0.0 LWA-2026-11002T1059.007T1059T1547.001T1113T1082
- internallib_v164@1.0.7 LWA-2026-10995T1059.007T1071.001T1105
- @dgn-src-click-to-pay-org/srcdcfreleasecert@999.0.1 LWA-2026-10992T1059.007T1082T1071.001
- minimalistic-assert-plus@1.1.7 LWA-2026-10991T1195.002T1059.007T1105T1071.001
- @tamago19/tamaaago@2.1.3 LWA-2026-10990T1195.002T1059.007T1105
- bs58-33@6.0.1 LWA-2026-10989T1195.002T1195
- base65-33x@5.0.2 LWA-2026-10988T1195.002T1041T1567
- neverthrow-core@1.1.2 LWA-2026-10987T1195.002T1059.007T1105T1573
- developer-dashboard@1.0.2 LWA-2026-10986T1552.001T1555T1005T1071.001T1102
- base65-15x@5.0.2 LWA-2026-10985T1195.002T1041T1071.001
- base65-77x@5.0.2 LWA-2026-10984T1195.002T1041T1071.001
- passkeys-react@1.0.1 LWA-2026-10972T1059.007T1082T1005T1041T1071.001
- twcvhjlksdmx@1.0.0 LWA-2026-10973T1566.002T1027T1189
- passport811@1.0.0 LWA-2026-10970T1566.002T1189T1539T1567T1071.001
- @openzeppelin-5/contracts@1.0.0 LWA-2026-10969T1195.002T1059.007T1082T1552.001T1552.004
- @openzeppelin-4/contracts@1.0.0 LWA-2026-10968T1195.002T1059.007T1552.001T1552.004T1082
- ghazaly@99.9.0 LWA-2026-10961T1059.007T1082T1071.001T1041
- permit2@1.0.0 LWA-2026-10958T1059.007T1552.001T1552.004T1082T1071.001
- dependencyfsdsfdsfg@99.9.0 LWA-2026-10957T1059.007T1082T1071.001T1041
- airdzticket@1.0.0 LWA-2026-10959T1195.002
- ethereum-vault-connector@1.0.0 LWA-2026-10956T1195.002T1059.007T1082T1552.001T1552.004
- @aerodrome-finance/slipstream@1.0.0 LWA-2026-10955T1059.007T1552.001T1082T1071.001T1041
- camelot-ammv2-periphery@1.0.0 LWA-2026-10954T1059.007T1082T1552.001T1005T1071.001
- boring-vault@1.0.0 LWA-2026-10953T1059.007T1082T1552.001T1552.004T1041
- @aerodrome-finance/contracts@1.0.0 LWA-2026-10951T1195.002T1059.007T1082T1552.001T1005
- camelot-ammv2-core@1.0.0 LWA-2026-10952T1195.002T1059.007T1082T1552.001T1552.004
- kit-vim-map@1.0.0 LWA-2026-10950T1059.007T1059T1105T1071T1573
- @sqlite-labs-free/createsql@1.0.5 LWA-2026-10949T1059.007T1105
- freeai-proxy@1.0.0 LWA-2026-10947T1059.007T1105
- vexium-kit@2.0.2 LWA-2026-10946T1059.007T1105T1071.001T1573
- process-live-log@11.5.2 LWA-2026-10941T1059.007T1105T1071.001
- @sqlite-labs/nodesql@1.0.5 LWA-2026-10937T1195.002T1059.007T1105T1071.001
- safe-local-env-loader@1.0.0 LWA-2026-10935T1059.007T1547.001T1113T1071.001T1105
- ventra-kit@1.0.2 LWA-2026-10936T1059.007T1105T1071.001
- @sqlite-labs/createsql@1.0.1 LWA-2026-10934T1059.007T1105T1071.001
- chai-as-reformed@1.2.0 LWA-2026-10933T1059.007T1105T1071.001T1195.002
- @bottino/baileys@1.0.1 LWA-2026-12501T1195.002T1195
- dayjs-advanced@1.2.0 LWA-2026-10932T1195.002T1059.007T1059T1105T1071.001
- eth-library-toolkit@2.1.3 LWA-2026-10931T1195.002T1059.007
- commonjs-assertion@1.2.7 LWA-2026-10930T1195.002T1059.007T1105T1071.001
- mnteckets@1.0.1 LWA-2026-10927T1189T1566.002
- polymarket-stake-mathss@3.5.2 LWA-2026-10926T1059.007T1105T1071.001
- runtimekit@1.1.0 LWA-2026-10922T1059.007T1105T1071.001T1102T1082
- @noobaihome/amis-simple-area-widget@1.0.0 LWA-2026-10916T1059.007T1082T1041
- hex-encode-utils@1.0.5 LWA-2026-10915T1059.007T1059T1105T1071.001T1082
- @noobaihome/amis-uni-area-widget@1.0.0 LWA-2026-10903T1059.007T1105T1071.001T1041
- neverthrow-js@2.0.0 LWA-2026-10904T1059.007T1105T1071.001
- postcss-initial-provider@3.0.4 LWA-2026-10902T1102T1105T1059.007T1573T1071.001
- godot-kit@1.0.1786316795 LWA-2026-10901T1059.007T1059T1105T1071.001T1102
- fsbrowse@0.2.28 LWA-2026-10900T1102T1105T1059.007T1071.001T1573
- @darshanpatel2608/cursor-dash@1.0.0 LWA-2026-10888T1552.001T1041T1071.001
- simple-date-formatter-new-10@1.0.0 LWA-2026-10873T1059T1059.007T1552.001T1082T1071.001
- simple-date-formatter-new-9@1.0.0 LWA-2026-10872T1059.004T1071.001
- cryptostock@1.0.0 LWA-2026-10867T1059T1059.007T1082T1552.001T1071.001
- envpack-conf@1.0.1 LWA-2026-10866T1059.007T1059T1105T1071.001T1573
- iconova-react@1.30.1 LWA-2026-10864T1195.002T1059.007T1105T1071.001T1102
- @polymarkets/clob-client-v2@1.0.6 LWA-2026-10859T1195.002T1105
- @devmikets/hyperliquid-sdk@1.9.6 LWA-2026-10852T1195.002T1105
- kit-map-streak@1.0.0 LWA-2026-10850T1059T1059.007T1105T1071T1573
- global-intel@1.0.1 LWA-2026-10849T1059.007T1082T1005T1071.001T1041
- wsallin@1.0.0 LWA-2026-10848T1059.007T1082T1071.001T1105T1059
- @opezneppelin/contracts@5.0.2 LWA-2026-10846T1195.002T1059.007T1059.003T1105
- statist-browser-typed-client-integration.tecm.events@0.0.1 LWA-2026-10847T1195.002
- @rblxts/services@1.6.0 LWA-2026-10845T1195.002T1059.007T1059.001T1105T1053
- statist-browser-typed-client-hra.renewal.events@0.0.1 LWA-2026-10844T1195.002
- statist-browser-typed-client-hra.peoplehub.web.metrics@0.0.1 LWA-2026-10843T1195.002
- statist-browser-typed-client-fsi.cm.web@0.0.1 LWA-2026-10842T1195.002
- statist-browser-typed-client-forge.informer.events@0.0.1 LWA-2026-10841T1195.002
- statist-browser-typed-client-forge.front.metrics@0.0.1 LWA-2026-10840T1195.002
- statist-browser-typed-client-eventea.spend.advisor@0.0.1 LWA-2026-10839T1195.002
- statist-browser-typed-client-eventea.saving.sphere.eng@0.0.1 LWA-2026-10838T1195.002
- statist-browser-typed-client-eventea.projects.xsellib@0.0.1 LWA-2026-10837T1195.002
- T1195.002
- @ethers-js/contracts@6.9.0 LWA-2026-10833T1059.007T1059.003T1059.006T1105T1195.002
- statist-browser-typed-client-eventea.projects.webview@0.0.1 LWA-2026-10836T1195.002
- T1195.002
- statist-browser-typed-client-eventea.projects.trealty@0.0.1 LWA-2026-10832T1195.002
- T1195.002
- @solana-js/web3@1.91.3 LWA-2026-10828T1195.002T1059.001T1059.007T1105T1055
- T1195.002
- statist-browser-typed-client-eventea.projects.tj@0.0.1 LWA-2026-10829T1195.002
- statist-browser-typed-client-eventea.projects.tdeal@0.0.1 LWA-2026-10827T1195.002
- @reducers/projects@99.9.1 LWA-2026-10826T1195.002T1105
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.