codex-setup@0.0.0-stage
Malicious code in codex-setup (npm)
Analysis
codex-setup@0.0.0-stage is an empty placeholder publish: the tarball contains only a package.json (name, version, "stub": true, description "Temporary package placeholder for staged publishing") and a README stating it is a temporary holding version awaiting a staged release. It declares no lifecycle scripts, no bin entries, no dependencies and ships no JavaScript, so this version contains no executable content and no network behaviour. The publish is a namespace-holding/staging artifact; no malicious code is present in this version and no IOCs can be reported from it. Analysis is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Oct 14, 2026, 09:21 AM
- analyzed
- Oct 14, 2026, 09:22 AM
Related advisories
- codex-setup@1.0.3 same package
- codex-setup@1.0.2 same package
- codex-setup@1.0.1 same package
- codex-setup@1.0.0 same package
- @decoopus/claude-setup@1.0.2
- claude-desktop-setup@0.0.0-stage
- css-compat-layer@11.0.9
- @apollolibraryorg/dotenv@1.0.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.