LWA-2026-10844 confirmed malware

statist-browser-typed-client-hra.renewal.events@0.0.1

Malicious code in statist-browser-typed-client-hra.renewal.events (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

An empty stub package (index.js contains only "module.exports = {}" with no functional code, no dependencies, and no lifecycle hooks) published under a name that impersonates a service-client library and carries a domain-like suffix in the package name. The package ships no executable payload, consistent with a name-squatting placeholder rather than a functional library.

analyzed by
Leitwacht
first seen
Aug 8, 2026, 02:19 PM
analyzed
Aug 8, 2026, 02:19 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.