@an1mshnpmb9c84920/stage-outer-m19s5@0.0.0-stage
Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm)
Analysis
This package is an empty placeholder stub, not a functional library. The tarball contains only package.json and README.md (358 bytes unpacked) with no executable code, no lifecycle hooks, no bin entries, no dependencies and no optional dependencies. package.json sets "stub": true and describes the package as a "Temporary package placeholder for staged publishing"; the README states the version is a temporary holding version pending a staged release. Nothing in this version executes on install and it contains no network code, no callback host and no other IOC. The name and metadata follow a staged-publishing pattern in which a scope reserves package names with inert stubs before a payload-bearing version is released under the same name.
- analyzed by
- Leitwacht
- first seen
- Oct 19, 2026, 07:09 PM
- analyzed
- Oct 19, 2026, 07:09 PM
Related advisories
- @an1mshnpmb9c84920/stage-repo-m19g7@0.0.0-stage
- @an1mshnpmb9c84920/pipe-dns-m19t2@0.0.0-stage
- @jm-telefonica/multibrand-components@99.9.1
- @factoryz/apollo@99.9.1
- tauri-cef-webview@0.0.0-stage
- @chatunitycenter/baileys@1.0.0
- neverthrow-js@5.0.0
- aldi02-baileys@0.0.0-stage
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.