@user-services/web-components@0.0.0-stage
Malicious code in @user-services/web-components (npm)
Analysis
@user-services/web-components@0.0.0-stage is a placeholder stub, not a functional package. The tarball contains only two files: package.json, which sets "stub": true and describes itself as a "Temporary package placeholder for staged publishing", and a README titled "Temporary Holding Version" stating that an operational version has been submitted for review and is awaiting a staged release. It declares no scripts, no bin entries, no dependencies and ships no executable code, so nothing runs on install. The version reserves the package name while a staged release is pending. No payload, network endpoint, credential access or dropped file is present in this tarball; the analysis is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Oct 12, 2026, 01:24 PM
- analyzed
- Oct 13, 2026, 12:13 AM
- weekly installs
- 144
Related advisories
- @user-services/web-components@9.9.10 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.