@an1mshnpmb9c84920/pipe-dns-m19t2@0.0.0-stage
Malicious code in @an1mshnpmb9c84920/pipe-dns-m19t2 (npm)
Analysis
This version of @an1mshnpmb9c84920/pipe-dns-m19t2 (0.0.0-stage) is a staged placeholder, not a functional package. The tarball contains only two files totalling 381 bytes: a package.json declaring "stub": true with the description "Temporary package placeholder for staged publishing" and no scripts, bin entries, dependencies or lifecycle hooks, and a README titled "Temporary Holding Version" stating that an operational version "has been submitted for review and is awaiting a staged release". No JavaScript or other executable code is present, so this version performs no network, filesystem or process activity and has no IOCs. It reserves the package name under a scope whose other publishes carry payloads, with the operational version intended to be swapped in on a later release; the analysis of this version is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Oct 19, 2026, 04:09 PM
- analyzed
- Oct 19, 2026, 04:10 PM
Related advisories
- @an1mshnpmb9c84920/stage-repo-m19g7@0.0.0-stage
- @factoryz/apollo@99.9.1
- @fmr-ap153177/apex-kit-icons@99.9.1
- @fmr-ap149494/apex-base-component@99.9.1
- tauri-cef-webview@0.0.0-stage
- @chatunitycenter/baileys@1.0.0
- neverthrow-js@5.0.0
- aldi02-baileys@0.0.0-stage
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.