vjkpwjxbvndelta@0.0.0-stage
Malicious code in vjkpwjxbvndelta (npm)
Analysis
This package is an empty placeholder publish: the tarball contains only package.json and README.md (337 bytes unpacked, 2 files) with no executable code, no lifecycle hooks, no bin entries and no dependencies. Its description self-identifies it as a "Temporary package placeholder for staged publishing" and it is published at version 0.0.0-stage. No malicious code, network endpoint, credential access or dropped file was found in this version — the analysis is metadata-only, and the package name should be treated as reserved for a follow-up publish that may carry a payload. No IOCs are available for this version.
- analyzed by
- Leitwacht
- first seen
- Oct 15, 2026, 06:44 AM
- analyzed
- Oct 15, 2026, 06:44 AM
Related advisories
- zxcvb90-utils-helper@1.0.1
- @decoopus/chatgpt-setup@0.0.0-stage
- chatgpt-desktop-setup@0.0.0-stage
- claude-desktop-setup@1.0.2
- claude-desktop-setup@1.0.11
- claude-desktop-setup@1.0.6
- claude-desktop-setup@1.0.5
- claude-desktop-setup@1.0.4
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.