Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 9 of 37.
- T1195.002
- statist-browser-typed-client-eventea.projects.pwakasko@0.0.1 LWA-2026-10825T1195.002
- T1195.002
- specials-resources-server@35.8.1 LWA-2026-10822T1059.007T1105T1071.001T1102T1082
- @kolbo/mcp@1.57.1 LWA-2026-10821T1059.007T1105T1071.001T1102T1573
- sme-rko-finance-front-operations-penalty@35.8.1 LWA-2026-10820T1105T1059T1059.007T1071.001T1102
- sme-rko-finance-front-operations-overnight@35.8.1 LWA-2026-10818T1105T1059.007T1071.001T1102T1082
- sme-rko-finance-front-operations-pegasus@35.8.1 LWA-2026-10817T1059T1059.007T1105T1071.001T1102
- sme-rko-finance-front-operations-fee@35.8.1 LWA-2026-10811T1105T1059.007T1071.001T1102T1008
- vitest-preview-pro@10.0.7 LWA-2026-10814T1059
- tailwindcss-motion-advanced@1.0.1 LWA-2026-10735T1195.002T1059.007T1105T1071.001T1102
- sme-rko-finance-front-operations-domain@35.8.1 LWA-2026-10810T1059T1059.007T1105T1071.001T1102
- sme-rko-finance-front-operations-feed-models@35.8.1 LWA-2026-10807T1059.007T1105T1071.001T1102T1082
- sme-rko-finance-front-operations-feed-impl@35.8.1 LWA-2026-10809T1059T1105T1071.001T1102T1082
- modern-localization@1.2.1 LWA-2026-10808T1059.007T1105T1071.001
- sme-rko-finance-front-operations-notifications-impl@35.8.1 LWA-2026-10804T1059.007T1105T1071.001T1071.004T1059
- sme-rko-finance-front-operations-notifications-models@35.8.1 LWA-2026-10803T1059.007T1105T1071.001T1102T1059
- sme-rko-finance-front-operations-holding-domain@35.8.1 LWA-2026-10806T1105T1059T1071.001T1102T1059.007
- sme-rko-finance-front-operations-income@35.8.1 LWA-2026-10805T1059.007T1105T1071.001T1102T1059
- sme-rko-finance-front-operations-other@35.8.1 LWA-2026-10802T1059.007T1105T1071.001T1102T1082
- gas-diff-core@1.0.1 LWA-2026-10815T1195.002
- map-streak-kit@1.0.0 LWA-2026-10800T1059.007T1059T1105T1071.001T1102
- titan-exchange-shared-permissions@99.9.9 LWA-2026-10801T1082T1071.001T1041
- @coralxyz/anchor@0.30.2 LWA-2026-10797T1195.002T1059.007T1059.001T1105T1027
- @rbx-ts/services@1.6.0 LWA-2026-10796T1059.007T1059.001T1105
- streak-map-kit@1.0.0 LWA-2026-10795T1059.007T1059T1082T1071T1105
- ts-utility-plus@1.3.2 LWA-2026-10794T1059.007T1105T1071.001
- forge-gas-diff@1.0.0 LWA-2026-10784T1059.007T1071.001T1102T1105
- hardhat-cap@2.21.1 LWA-2026-10781T1059.007T1082T1071.001T1041T1027
- damir-cbr-dawdntrnssbf@35.8.1 LWA-2026-10778T1059.007T1105T1071.001T1102T1059
- platform-ui-colors@35.8.1 LWA-2026-10779T1059T1059.007T1105T1071.001T1102
- distributorblock@35.8.1 LWA-2026-10777T1059.007T1105T1071.001T1102T1082
- dolyame-ui-attachfile@35.8.1 LWA-2026-10776T1059T1059.007T1105T1071.001T1102
- dolyame-ui-buttonstore@35.8.1 LWA-2026-10772T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-clickoutsidehoc@35.8.1 LWA-2026-10768T1059.007T1059T1105T1071.001T1102
- dolyame-ui-cardlogo@35.8.1 LWA-2026-10771T1195.002T1059.007T1105T1071.001T1071.004
- dolyame-ui-carouselline@35.8.1 LWA-2026-10770T1059.007T1105T1071.001T1102T1082
- dolyame-ui-checkablegroup@35.8.1 LWA-2026-10769T1059.007T1059T1105T1071.001T1102
- dolyame-ui-contextmenu@35.8.1 LWA-2026-10765T1105T1071.001T1071.004T1059T1102
- dolyame-ui-collapseblock@35.8.1 LWA-2026-10767T1059T1105T1071.001T1102T1082
- dolyame-ui-contenteditable@35.8.1 LWA-2026-10766T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-contextmenusearchable@35.8.1 LWA-2026-10764T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-eventoutside@35.8.1 LWA-2026-10762T1059.007T1059T1105T1071.001T1102
- dolyame-ui-draghoc@35.8.1 LWA-2026-10763T1059T1059.007T1105T1071.001T1102
- dolyame-ui-flatcorners@35.8.1 LWA-2026-10761T1059T1059.007T1105T1071.001T1102
- dolyame-ui-focusstatehoc@35.8.1 LWA-2026-10750T1059.007T1059T1105T1071.001T1102
- eacq-dialog@35.8.1 LWA-2026-10746T1059T1059.007T1105T1071.001T1102
- eacq-core@35.8.1 LWA-2026-10747T1059.007T1105T1071.001T1102T1567
- eacq-cdk@35.8.1 LWA-2026-10748T1059.007T1059T1105T1071.001T1102
- dolyame-ui-tabslayout@35.8.1 LWA-2026-10749T1105T1059.007T1071.001T1102T1082
- dolyame-ui-memoizeweak@35.8.1 LWA-2026-10731T1059T1059.007T1105T1071.001T1102
- dolyame-ui-mediainfohoc@35.8.1 LWA-2026-10732T1059T1059.007T1105T1071.001T1071.004
- dolyame-ui-lazyrender@35.8.1 LWA-2026-10733T1105T1059.007T1059T1071.001T1102
- dolyame-ui-inputtools@35.8.1 LWA-2026-10734T1059.007T1105T1071.001T1102T1059
- dolyame-ui-inputtime@35.8.1 LWA-2026-10736T1059T1059.007T1105T1071.001T1071.004
- dolyame-ui-noindex@35.8.1 LWA-2026-10730T1105T1059.007T1059T1071.001T1102
- dolyame-ui-overridestyles@35.8.1 LWA-2026-10729T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-pageheader@35.8.1 LWA-2026-10728T1059.007T1105T1071.001T1102T1059
- dolyame-ui-progressline@35.8.1 LWA-2026-10723T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-popupcarousel@35.8.1 LWA-2026-10727T1059.007T1105T1071.001T1102T1059
- dolyame-ui-progresscircle@35.8.1 LWA-2026-10724T1059.007T1105T1071.001T1102T1568
- dolyame-ui-postcssconfig@35.8.1 LWA-2026-10726T1195.002T1059.007T1105T1071.001T1102
- dolyame-ui-postcsscustomproperties@35.8.1 LWA-2026-10725T1059.007T1105T1071.001T1102T1059
- dolyame-ui-selectaccount@35.8.1 LWA-2026-10721T1059.007T1059T1105T1071.001T1071.004
- dolyame-ui-sortablelist@35.8.1 LWA-2026-10720T1059T1059.007T1105T1071.001T1102
- dolyame-ui-stateutils@35.8.1 LWA-2026-10719T1195.002T1059.007T1105T1071.001T1071.004
- dolyame-ui-scrollblock@35.8.1 LWA-2026-10722T1059.007T1105T1071.001T1102T1059
- dolyame-ui-tablemobile@35.8.1 LWA-2026-10717T1059T1059.007T1105T1071.001T1102
- dolyame-ui-tableinline@35.8.1 LWA-2026-10718T1059.007T1105T1071.001T1071.004T1102
- dolyame-ui-tabsblock@35.8.1 LWA-2026-10716T1059.007T1105T1071.001T1102T1041
- dolyame-ui-dataqa@35.8.1 LWA-2026-10715T1195.002T1059.007T1105T1071.001T1102
- @rbxst/services@1.0.756 LWA-2026-10714T1195.002T1059.007T1105T1059
- txrand@1.0.6 LWA-2026-10712T1059T1105T1027
- @fedfub/string-utils@1.0.0 LWA-2026-10711T1059.007T1195.002T1082T1005T1552.001
- streak-kit-map@1.0.0 LWA-2026-10710T1195.002T1059.007T1059T1547T1053
- bnpl-blocks-atom-bnpl-faq-item@35.8.2 LWA-2026-10709T1059.007T1059T1105T1071.001T1102
- dolyame-boxy-independent-bnpl-faq@35.8.7 LWA-2026-10707T1059.007T1105T1071.001T1102T1082
- devplatform-react-mcp@35.5.6 LWA-2026-10708T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-independent-bnpl-main-title@35.5.6 LWA-2026-10706T1195.002T1059.007T1105T1071.001T1102
- beaver-ui-popover-marker@35.5.8 LWA-2026-10705T1059.007T1105T1071.001T1102T1082
- bigops-telephony-mock@35.7.2 LWA-2026-10703T1059.007T1105T1071.001T1071.004T1082
- bnpl-blocks-atom-bnpl-checkbox@35.6.1 LWA-2026-10702T1059.007T1105T1071.001T1102T1059
- bnpl-blocks-atom-bnpl-loader@35.1.2 LWA-2026-10700T1059.007T1105T1071.001T1102T1059
- ded-pwa-c-boxy-di@35.2.2 LWA-2026-10697T1059T1059.007T1105T1071.001T1102
- bnpl-blocks-atom-bnpl-image-card@35.6.1 LWA-2026-10701T1195.002T1059.007T1059T1105T1071.001
- ded-pwa-c-boxy@35.9.1 LWA-2026-10698T1059.007T1105T1071.001T1102T1567
- ded-pwa-bnpl-forms-test-demo@35.7.8 LWA-2026-10699T1059.007T1105T1071.001T1082T1059
- ded-pwa-c-mapping@35.8.7 LWA-2026-10695T1105T1071.001T1102T1059T1059.007
- ded-pwa-c-cms@35.9.9 LWA-2026-10696T1059.007T1105T1071.001T1102T1082
- ded-pwa-ded-pwa-core@35.6.3 LWA-2026-10692T1059.007T1105T1071.001T1102T1082
- ded-pwa-test-pub-pkg@35.8.4 LWA-2026-10691T1059.007T1105T1071.001T1102.001T1082
- ded-pwa-c-page-maker-props@35.7.7 LWA-2026-10693T1195.002T1059.007T1105T1071.001T1071.004
- ded-pwa-c-micro@35.8.3 LWA-2026-10694T1195.002T1059.007T1059T1105T1071.001
- delivery-ci-codeceptjs-fork@35.4.5 LWA-2026-10688T1195.002T1059.007T1105T1071.001T1102
- delivery-ci-codeceptjs@35.1.7 LWA-2026-10689T1195.002T1059.007T1059T1105T1071.001
- delivery-ci-cli@35.3.5 LWA-2026-10690T1059.007T1059T1105T1071.001T1102
- bigops-security@35.8.8 LWA-2026-10687T1059T1059.007T1105T1071.001T1102
- delivery-ci-documentation@35.3.7 LWA-2026-10685T1059.007T1059T1105T1071.001T1102
- delivery-ci-jira@35.5.2 LWA-2026-10683T1059T1105T1071.004T1071.001T1055
- delivery-ci-core@35.3.7 LWA-2026-10686T1105T1059T1071.001T1102T1082
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.