@lekzo_dev/amprem@0.0.0-stage
Malicious code in @lekzo_dev/amprem (npm)
Analysis
This version of @lekzo_dev/amprem contains no executable code: the tarball holds only package.json (name, version 0.0.0-stage, "stub": true) and a README.md stating it is a temporary placeholder for a staged release. It declares no scripts, no bin entries, no dependencies and no lifecycle hooks, so installing it runs nothing and contacts nothing. The concern is the package name itself: @lekzo_dev/amprem is a re-publication of a name that has previously been used to distribute malicious code, and this empty placeholder reserves the name ahead of a follow-up release. No malicious code is present in this version; the analysis is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Oct 12, 2026, 03:34 PM
- analyzed
- Oct 13, 2026, 12:13 AM
Related advisories
- @lekzo_dev/amprem@1.0.4 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.