LWA-2026-13090 confirmed malware

@an1mshnpmb9c84920/stage-outer-m19s5@0.0.0-stage

Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package is an empty placeholder stub, not a functional library. The tarball contains only package.json and README.md (358 bytes unpacked) with no executable code, no lifecycle hooks, no bin entries, no dependencies and no optional dependencies. package.json sets "stub": true and describes the package as a "Temporary package placeholder for staged publishing"; the README states the version is a temporary holding version pending a staged release. Nothing in this version executes on install and it contains no network code, no callback host and no other IOC. The name and metadata follow a staged-publishing pattern in which a scope reserves package names with inert stubs before a payload-bearing version is released under the same name.

analyzed by
Leitwacht
first seen
Oct 19, 2026, 07:09 PM
analyzed
Oct 19, 2026, 07:09 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.