nwfp-prettier-config@0.0.0-stage
Malicious code in nwfp-prettier-config (npm)
Analysis
This publish is a 342-byte placeholder stub: a package.json containing only name, version, description and a "stub": true marker (no scripts, no bin, no dependencies) plus a README stating it is a temporary placeholder whose operational version is awaiting a staged release. It ships no JavaScript, no lifecycle hook and no network code, so there is no executable behaviour to describe in this version. The analysis here is metadata-only: the version is a name-reservation placeholder published under the same nwfp-* name family as nwfp-build-config@1.0.0, which carries the executable payload.
- analyzed by
- Leitwacht
- first seen
- Oct 16, 2026, 06:26 PM
- analyzed
- Oct 16, 2026, 06:27 PM
Related advisories
- @mntv-analysis/workspaces-components@0.0.0-stage
- vjkpwjxbvndelta@0.0.0-stage
- zxcvb90-utils-helper@1.0.1
- @decoopus/chatgpt-setup@0.0.0-stage
- chatgpt-desktop-setup@0.0.0-stage
- claude-desktop-setup@1.0.2
- claude-desktop-setup@1.0.11
- claude-desktop-setup@1.0.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.