LWA-2026-12956 confirmed malware
nodetokyo@0.0.0-stage
Malicious code in nodetokyo (npm)
Analysis
nodetokyo@0.0.0-stage is a placeholder publish that ships no executable code: the tarball contains only package.json (which declares "stub": true and describes itself as a "Temporary package placeholder for staged publishing") and a README stating it is a temporary holding version pending a staged release. There are no lifecycle scripts, no bin entries, and no JavaScript files, so installing this version runs nothing. It reserves the nodetokyo package name ahead of a later release. No malicious behaviour is present in this version; the analysis is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Oct 12, 2026, 03:59 AM
- analyzed
- Oct 12, 2026, 03:59 AM
Related advisories
- nodetokyo@1.0.9 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.