LWA-2026-12107 confirmed malware
vl-ui-accordion@1.0.0
Malicious code in vl-ui-accordion (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
vl-ui-accordion@1.0.0 is an inert placeholder package published under the name of the real vl-ui-* (Flemish government) UI component library family. The tarball contains only a package.json with empty install hooks and an index.js holding a single comment; there is no repository, no code, and no dependencies. It is a name-squat placeholder occupying the namespace of a legitimate component library, with no functional implementation shipped.
- analyzed by
- Leitwacht
- first seen
- Sep 14, 2026, 12:18 PM
- analyzed
- Sep 14, 2026, 12:19 PM
Related advisories
- pino-ulid@2.12.3
- hardhat-base@2.2.0
- fast-xml-tagger@1.1.0
- noblox-asset.js@7.4.1
- @reause/rxjs@0.1.2
- @reause/electron@0.1.2
- @reause/math@0.1.2
- tailwindcss-contact-forms@0.5.8
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.