LWA-2026-13073 confirmed malware

aldi02-baileys@0.0.0-stage

Malicious code in aldi02-baileys (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package version is a non-functional placeholder: a 336-byte tarball containing only a package.json and a README, with no JavaScript, no lifecycle hooks, no bin entries, no dependencies and no network or filesystem activity. The README describes it as a "Temporary Holding Version" whose operational replacement is awaiting a staged release, indicating the name is being reserved ahead of a payload release. The package name is a combosquat of the widely used `baileys` WhatsApp library. No IOCs are present in this version; the analysis is metadata-only and the operational payload is not included in this tarball.

analyzed by
Leitwacht
first seen
Oct 18, 2026, 04:32 AM
analyzed
Oct 18, 2026, 04:33 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.