LWA-2026-12113 confirmed malware
vl-ui-datepicker@1.0.0
Malicious code in vl-ui-datepicker (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
vl-ui-datepicker@1.0.0 is a combosquat placeholder impersonating the vl-ui design-system component namespace. The package ships no functional code: index.js contains only a comment, and there are no lifecycle hooks, scripts, binaries, or dependencies. It is a name-squatting package that reserves a plausible vl-ui component name (datepicker) under the trusted vl-ui naming convention, with no legitimate implementation.
- analyzed by
- Leitwacht
- first seen
- Sep 14, 2026, 12:19 PM
- analyzed
- Sep 14, 2026, 12:19 PM
Related advisories
- vl-ui-demo@1.0.0
- vl-ui-data-table@1.0.0
- vl-ui-core@1.0.0
- vl-ui-accordion@1.0.0
- pino-ulid@2.12.3
- hardhat-base@2.2.0
- fast-xml-tagger@1.1.0
- noblox-asset.js@7.4.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.