LWA-2026-12232 confirmed malware

@shared-runtime/config@9.9.9

Malicious code in @shared-runtime/config (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

@shared-runtime/config@9.9.9 is a dependency-confusion/version-squat package: a scoped name published at a high sentinel version (9.9.9) containing only a 650-byte placeholder stub (index.js exports an empty object) with no real implementation. The package is designed to be resolved by internal dependency resolution in place of a legitimate shared-runtime config module, and the placeholder entrypoint indicates a staged delivery where the actual payload is deferred to a later version. No repository, no documentation of substance.

analyzed by
Leitwacht
first seen
Sep 18, 2026, 09:03 AM
analyzed
Sep 18, 2026, 09:04 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.