LWA-2026-12338 confirmed malware
pistolo@1.0.0
Malicious code in pistolo (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
pistolo@1.0.0 is a casino-promotion package that advertises the gambling site casino-pistolo[.]cz. It ships a minimal 3-file package with no repository and no declared functionality beyond promoting the casino destination. The package is part of a broader pattern of gambling-spam packages that reference casino/betting sites in their metadata. No executable payload or network exfiltration was identified in the package metadata; the malicious character is the deceptive casino-promotion spam distribution.
- analyzed by
- Leitwacht
- first seen
- Sep 22, 2026, 10:50 PM
- analyzed
- Sep 22, 2026, 10:51 PM
Related advisories
- turbo-ws@1.0.0
- envforge2@1.0.1
- @tvg-mar/storyblok-bridge@9.9.9
- @tesla-insurance/vinless-quote@9.9.10
- @tink/config@9.9.9
- tlxbnhd@0.0.1
- @andrewstory18/is-real-odd@2.0.2
- @uh-platform/domain-widget@100.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.