aemath-baileys@0.0.0-stage
Malicious code in aemath-baileys (npm)
Analysis
This package is an empty placeholder published under a name that impersonates the legitimate `baileys` WhatsApp library — a combosquat that keeps the real name intact and adds a prefix. The published tarball contains only a package.json and a README (336 bytes total): no JavaScript, no lifecycle hooks, no dependencies, no bin entries, and no network indicators. The package's own description and README describe it as a "temporary package placeholder for staged publishing" / "temporary holding version" awaiting a staged release. No executable behaviour is present in this version; the analysis is metadata-only and no IOCs were observed.
- analyzed by
- Leitwacht
- first seen
- Oct 17, 2026, 02:32 PM
- analyzed
- Oct 17, 2026, 02:33 PM
Related advisories
- nwfp-prettier-config@0.0.0-stage
- @mntv-analysis/workspaces-components@0.0.0-stage
- vjkpwjxbvndelta@0.0.0-stage
- zxcvb90-utils-helper@1.0.1
- @decoopus/chatgpt-setup@0.0.0-stage
- chatgpt-desktop-setup@0.0.0-stage
- claude-desktop-setup@1.0.2
- claude-desktop-setup@1.0.11
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.