LWA-2026-11605 confirmed malware
pantheon-secrets@1.0.0
Malicious code in pantheon-secrets (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
pantheon-secrets@1.0.0 is an empty package containing only a package.json manifest (no executable code, no lifecycle hooks, no bin entries). The publish is a namespace-claim with no functional content, reserving the name "pantheon-secrets" with no install-time behavior present in the tarball. The empty-publish shape is consistent with name-reservation ahead of a future supply-chain attack.
- analyzed by
- Leitwacht
- first seen
- Aug 24, 2026, 05:01 PM
- analyzed
- Aug 24, 2026, 05:01 PM
Related advisories
- @atfm/typeface@99.99.99
- dsh-tauri-ui@0.1.0
- sm-session@99.0.0
- modules-newline@0.0.6
- @fyxzpediaa/baileys@8.0.15
- kelly-sizing@0.1.0
- @next-fonts/font@1.0.1
- asistenyorstore@8.0.14
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.