LWA-2026-13013 confirmed malware

codex-setup@0.0.0-stage

Malicious code in codex-setup (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

codex-setup@0.0.0-stage is an empty placeholder publish: the tarball contains only a package.json (name, version, "stub": true, description "Temporary package placeholder for staged publishing") and a README stating it is a temporary holding version awaiting a staged release. It declares no lifecycle scripts, no bin entries, no dependencies and ships no JavaScript, so this version contains no executable content and no network behaviour. The publish is a namespace-holding/staging artifact; no malicious code is present in this version and no IOCs can be reported from it. Analysis is metadata-only.

analyzed by
Leitwacht
first seen
Oct 14, 2026, 09:21 AM
analyzed
Oct 14, 2026, 09:22 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.