LWA-2026-13056 confirmed malware

@decoopus/chatgpt-setup@0.0.0-stage

Malicious code in @decoopus/chatgpt-setup (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package is an inert placeholder published under a name previously used to distribute malicious code. Version 0.0.0-stage contains only package.json and README.md — no JavaScript, no lifecycle hooks, no dependencies, no bin entries — and its README describes it as a "temporary holding version" with an "operational version" awaiting a staged release. It installs nothing and executes nothing; it exists to reserve the @decoopus/chatgpt-setup name on the registry ahead of a payload release. No network indicators, dropped files, or credential access are present in this version. Treat any later release of this name as untrusted.

analyzed by
Leitwacht
first seen
Oct 14, 2026, 10:36 AM
analyzed
Oct 14, 2026, 10:39 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.