LWA-2026-11606 confirmed malware
mastercard-cc-sdk@1.0.0
Malicious code in mastercard-cc-sdk (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
mastercard-cc-sdk@1.0.0 is an empty package (package.json only, no code, no install scripts) published under a name that impersonates the Mastercard credit-card SDK. The package ships no functionality and no repository or documentation; its sole purpose is to reserve the brand-impersonating name so that installs expecting a Mastercard SDK receive this package instead. No executable payload is present in this version.
- analyzed by
- Leitwacht
- first seen
- Aug 24, 2026, 05:35 PM
- analyzed
- Aug 24, 2026, 05:35 PM
Related advisories
- pantheon-secrets@1.0.0
- @atfm/typeface@99.99.99
- dsh-tauri-ui@0.1.0
- sm-session@99.0.0
- modules-newline@0.0.6
- @fyxzpediaa/baileys@8.0.15
- kelly-sizing@0.1.0
- @next-fonts/font@1.0.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.