LWA-2026-12116 confirmed malware
vl-ui-doormat@1.0.0
Malicious code in vl-ui-doormat (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
vl-ui-doormat@1.0.0 is a combosquat placeholder published on the vl-ui namespace (a real UI-component library family). The package ships no functional code: its single index.js contains only a comment, and its install hooks are empty. It is a name-squatting decoy with no legitimate functionality.
- analyzed by
- Leitwacht
- first seen
- Sep 14, 2026, 12:19 PM
- analyzed
- Sep 14, 2026, 12:21 PM
Related advisories
- vl-ui-content-header@1.0.0
- vl-ui-cookie-consent@1.0.0
- vl-ui-cookie-statement@1.0.0
- vl-ui-description-data@1.0.0
- vl-ui-datepicker@1.0.0
- vl-ui-demo@1.0.0
- vl-ui-data-table@1.0.0
- vl-ui-core@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.