LWA-2026-12961 confirmed malware
npmscript_tesstalert_unpkg@0.0.0-stage
Malicious code in npmscript_tesstalert_unpkg (npm)
Analysis
npmscript_tesstalert_unpkg@0.0.0-stage is an empty placeholder publish: the tarball contains only package.json and README.md (348 bytes total), with no scripts, bin entries, lifecycle hooks, or JavaScript, so installing it executes nothing. The README describes the version as a temporary placeholder for a staged release, and the package name has previously carried malicious versions. No payload is present in this version; this record is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Oct 12, 2026, 12:39 PM
- analyzed
- Oct 13, 2026, 12:13 AM
- weekly installs
- 520
Related advisories
- npmscript_tesstalert_unpkg@1.0.1 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.