So is there a list of the most popular apps that made use of the infected lotusbail npm package?

NPM show 0 dependents in public packages. The 56k downloads number can easily have been be gamed by automation and therefore not a reliable signal of popularity.