LWA-2026-10823 confirmed malware
statist-browser-typed-client-eventea.projects.pwafamily@35.8.0
Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
statist-browser-typed-client-eventea.projects.pwafamily@35.8.0 is an empty stub package: index.js contains only module.exports = {} with no lifecycle scripts, no dependencies, and no executable code. It is published under a combosquat-style name that mimics legitimate infrastructure packages. This version ships no payload; the package is a placeholder with no observable behaviour.
- analyzed by
- Leitwacht
- first seen
- Aug 8, 2026, 07:08 AM
- analyzed
- Aug 8, 2026, 07:08 AM
Related advisories
- @kolbo/mcp@1.57.1
- gas-diff-core@1.0.1
- @coralxyz/anchor@0.30.2
- dolyame-ui-buttonstore@35.8.1
- dolyame-ui-cardlogo@35.8.1
- dolyame-ui-contenteditable@35.8.1
- dolyame-ui-contextmenusearchable@35.8.1
- dolyame-ui-flatcorners@35.8.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.