LWA-2026-13070 confirmed malware

nwfp-prettier-config@0.0.0-stage

Malicious code in nwfp-prettier-config (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This publish is a 342-byte placeholder stub: a package.json containing only name, version, description and a "stub": true marker (no scripts, no bin, no dependencies) plus a README stating it is a temporary placeholder whose operational version is awaiting a staged release. It ships no JavaScript, no lifecycle hook and no network code, so there is no executable behaviour to describe in this version. The analysis here is metadata-only: the version is a name-reservation placeholder published under the same nwfp-* name family as nwfp-build-config@1.0.0, which carries the executable payload.

analyzed by
Leitwacht
first seen
Oct 16, 2026, 06:26 PM
analyzed
Oct 16, 2026, 06:27 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.