@baanx/blockchain-config@9.9.9
Malicious code in @baanx/blockchain-config (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
@baanx/blockchain-config@9.9.9 is a dependency-confusion squat: a placeholder package published under a scoped name at version 9.9.9 with no implementation (index.js exports an empty object, no lifecycle hooks, no repository, no dependencies). The package ships only a stub entrypoint and a smoke test, consistent with squatting a scoped package name to intercept installs intended for a private/internal package. No executable payload is present in this version.
- analyzed by
- Leitwacht
- first seen
- Sep 20, 2026, 12:33 PM
- analyzed
- Sep 20, 2026, 12:33 PM
Related advisories
- @baanx/abis@9.9.9
- @baanx/domain@9.9.9
- @baanx/common@9.9.9
- @dbbhk/ui-components@99.0.0
- ndmcmsujey@1.0.0
- starbucks-sdk@1.0.0
- chai-as-viem@1.1.3
- keroeltopkkk@99.99.99
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.