LWA-2026-13067 confirmed malware

asistenyorstore@0.0.0-stage

Malicious code in asistenyorstore (npm)

Analysis

This version of asistenyorstore ships no executable code: the tarball contains only package.json and README.md (337 bytes total). The manifest marks it stub:true with the description "Temporary package placeholder for staged publishing", and the README describes it as a "Temporary Holding Version" awaiting a staged release. The package name has previously been used to publish malicious code; this release is a code-free placeholder that reserves the name ahead of a future payload. No network, credential, or file access behaviour is present in this version.

analyzed by
Leitwacht
first seen
Oct 16, 2026, 01:28 AM
analyzed
Oct 16, 2026, 01:29 AM
weekly installs
61

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.