liferay-workspace-scripts@0.0.0-stage
Malicious code in liferay-workspace-scripts (npm)
Analysis
This package is an empty placeholder published under the unscoped name liferay-workspace-scripts, imitating the naming of Liferay's official tooling packages. The tarball contains only package.json and README.md (347 bytes unpacked): no executable code, no lifecycle hooks, no dependencies, no bin entries and no network activity. package.json declares "stub": true and version 0.0.0-stage, and the README describes it as a "temporary holding version" awaiting a "staged release". It is a namespace-claim artifact — a name reserved ahead of a future payload — so installing this version currently does nothing. Analysis is metadata-only: there is no code in the package to inspect.
- analyzed by
- Leitwacht
- first seen
- Oct 10, 2026, 09:17 AM
- analyzed
- Oct 12, 2026, 01:11 AM
Related advisories
- orderly-plugin-liquidity-heatmap@1.0.6
- @teamqadeer1/baileys@1.0.0
- orderly-plugin-liquidity-heatmap@1.0.4
- tailwindcss-form@0.0.0-stage
- @coopeuch/button@1.999.999
- noxleyss@2.0.0
- @library-wide/library-shell@99.9.1
- @galicia-toolkit-nestjs/paas@999.0.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.