LWA-2026-13047 confirmed malware

@decoopus/claude-setup@0.0.0-stage

Malicious code in @decoopus/claude-setup (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package version is an inert placeholder: the tarball contains only package.json and README.md (371 bytes total) with no executable code, no lifecycle scripts, no bin entries and no dependencies. The README describes it as a temporary placeholder for a staged release. It is published under the name @decoopus/claude-setup, a name that has previously been used to distribute malicious code; this placeholder reserves the name ahead of a subsequent publish. No malicious behaviour is present in this version's files — this record is metadata-only, and the risk is the name being staged for a future malicious release.

analyzed by
Leitwacht
first seen
Oct 14, 2026, 10:20 AM
analyzed
Oct 14, 2026, 10:25 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.