aldi02-baileys@0.0.0-stage
Malicious code in aldi02-baileys (npm)
Analysis
This package version is a non-functional placeholder: a 336-byte tarball containing only a package.json and a README, with no JavaScript, no lifecycle hooks, no bin entries, no dependencies and no network or filesystem activity. The README describes it as a "Temporary Holding Version" whose operational replacement is awaiting a staged release, indicating the name is being reserved ahead of a payload release. The package name is a combosquat of the widely used `baileys` WhatsApp library. No IOCs are present in this version; the analysis is metadata-only and the operational payload is not included in this tarball.
- analyzed by
- Leitwacht
- first seen
- Oct 18, 2026, 04:32 AM
- analyzed
- Oct 18, 2026, 04:33 AM
Related advisories
- aemath-baileys@0.0.0-stage
- nwfp-prettier-config@0.0.0-stage
- @mntv-analysis/workspaces-components@0.0.0-stage
- vjkpwjxbvndelta@0.0.0-stage
- zxcvb90-utils-helper@1.0.1
- @decoopus/chatgpt-setup@0.0.0-stage
- chatgpt-desktop-setup@0.0.0-stage
- @decoopus/chatgpt-setup@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.