@decoopus/claude-setup@0.0.0-stage
Malicious code in @decoopus/claude-setup (npm)
Analysis
This package version is an inert placeholder: the tarball contains only package.json and README.md (371 bytes total) with no executable code, no lifecycle scripts, no bin entries and no dependencies. The README describes it as a temporary placeholder for a staged release. It is published under the name @decoopus/claude-setup, a name that has previously been used to distribute malicious code; this placeholder reserves the name ahead of a subsequent publish. No malicious behaviour is present in this version's files — this record is metadata-only, and the risk is the name being staged for a future malicious release.
- analyzed by
- Leitwacht
- first seen
- Oct 14, 2026, 10:20 AM
- analyzed
- Oct 14, 2026, 10:25 AM
Related advisories
- @decoopus/claude-setup@1.0.1 same package
- @decoopus/claude-setup@1.0.3 same package
- @decoopus/claude-setup@1.0.2 same package
- @decoopus/chatgpt-setup@0.0.0-stage
- @decoopus/chatgpt-setup@1.0.1
- @decoopus/chatgpt-setup@1.0.0
- @flexmr/survey-client@10.0.12
- claude-desktop-setup@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.