LWA-2026-12943 confirmed malware

liferay-workspace-scripts@0.0.0-stage

Malicious code in liferay-workspace-scripts (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package is an empty placeholder published under the unscoped name liferay-workspace-scripts, imitating the naming of Liferay's official tooling packages. The tarball contains only package.json and README.md (347 bytes unpacked): no executable code, no lifecycle hooks, no dependencies, no bin entries and no network activity. package.json declares "stub": true and version 0.0.0-stage, and the README describes it as a "temporary holding version" awaiting a "staged release". It is a namespace-claim artifact — a name reserved ahead of a future payload — so installing this version currently does nothing. Analysis is metadata-only: there is no code in the package to inspect.

analyzed by
Leitwacht
first seen
Oct 10, 2026, 09:17 AM
analyzed
Oct 12, 2026, 01:11 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.