LWA-2026-13088 confirmed malware
@an1mshnpmb9c84920/stage-repo-m19g7@0.0.0-stage
Malicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
This package is a namespace-claim placeholder stub. It contains only package.json and README.md (357 bytes unpacked), declares "stub": true, and describes itself as a "Temporary package placeholder for staged publishing." It ships no executable code, no lifecycle hooks, no dependencies, and no network behaviour. The package reserves the @an1mshnpmb9c84920/stage-repo-m19g7 name for a later staged release. No IOCs are present in this version.
- analyzed by
- Leitwacht
- first seen
- Oct 19, 2026, 04:39 PM
- analyzed
- Oct 19, 2026, 04:40 PM
Related advisories
- @an1mshnpmb9c84920/pipe-dns-m19t2@0.0.0-stage
- @factoryz/apollo@99.9.1
- @fmr-ap153177/apex-kit-icons@99.9.1
- @fmr-ap149494/apex-base-component@99.9.1
- tauri-cef-webview@0.0.0-stage
- @chatunitycenter/baileys@1.0.0
- neverthrow-js@5.0.0
- aldi02-baileys@0.0.0-stage
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.