LWA-2026-12957 confirmed malware
nodetokyo-us@0.0.0-stage
Malicious code in nodetokyo-us (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
This package is a placeholder stub: the tarball contains only package.json and README.md (334 bytes total, no executable code, no lifecycle hooks, no dependencies). package.json sets "stub": true at version 0.0.0-stage, and the README states it is a "temporary placeholder" for a staged release. It reserves the name nodetokyo-us without shipping any code. No network, credential, or file behaviour is present in this version; the analysis is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Oct 12, 2026, 04:59 AM
- analyzed
- Oct 12, 2026, 05:00 AM
Related advisories
- liferay-workspace-scripts@0.0.0-stage
- orderly-plugin-liquidity-heatmap@1.0.6
- @teamqadeer1/baileys@1.0.0
- orderly-plugin-liquidity-heatmap@1.0.4
- tailwindcss-form@0.0.0-stage
- @coopeuch/button@1.999.999
- noxleyss@2.0.0
- @library-wide/library-shell@99.9.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.