@decoopus/chatgpt-setup@0.0.0-stage
Malicious code in @decoopus/chatgpt-setup (npm)
Analysis
This package is an inert placeholder published under a name previously used to distribute malicious code. Version 0.0.0-stage contains only package.json and README.md — no JavaScript, no lifecycle hooks, no dependencies, no bin entries — and its README describes it as a "temporary holding version" with an "operational version" awaiting a staged release. It installs nothing and executes nothing; it exists to reserve the @decoopus/chatgpt-setup name on the registry ahead of a payload release. No network indicators, dropped files, or credential access are present in this version. Treat any later release of this name as untrusted.
- analyzed by
- Leitwacht
- first seen
- Oct 14, 2026, 10:36 AM
- analyzed
- Oct 14, 2026, 10:39 AM
Related advisories
- @decoopus/chatgpt-setup@1.0.1 same package
- @decoopus/chatgpt-setup@1.0.0 same package
- @decoopus/claude-setup@0.0.0-stage
- @decoopus/claude-setup@1.0.1
- @decoopus/claude-setup@1.0.3
- chatgpt-desktop-setup@0.0.0-stage
- claude-desktop-setup@1.0.2
- claude-desktop-setup@1.0.11
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.