LWA-2026-13061 confirmed malware

vjkpwjxbvndelta@0.0.0-stage

Malicious code in vjkpwjxbvndelta (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package is an empty placeholder publish: the tarball contains only package.json and README.md (337 bytes unpacked, 2 files) with no executable code, no lifecycle hooks, no bin entries and no dependencies. Its description self-identifies it as a "Temporary package placeholder for staged publishing" and it is published at version 0.0.0-stage. No malicious code, network endpoint, credential access or dropped file was found in this version — the analysis is metadata-only, and the package name should be treated as reserved for a follow-up publish that may carry a payload. No IOCs are available for this version.

analyzed by
Leitwacht
first seen
Oct 15, 2026, 06:44 AM
analyzed
Oct 15, 2026, 06:44 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.