LWA-2026-12114 confirmed malware

vl-ui-demo@1.0.0

Malicious code in vl-ui-demo (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

vl-ui-demo@1.0.0 is an empty placeholder package (a comment-only index.js, no lifecycle hooks, no dependencies, no executable code) published under the vl-ui-* name family, which impersonates the vl-ui design-system library namespace. The package ships no functional payload; its significance is the combosquat name and the namespace-squatting pattern. No network endpoints, credentials, or files are involved in this version.

analyzed by
Leitwacht
first seen
Sep 14, 2026, 12:19 PM
analyzed
Sep 14, 2026, 12:19 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.