@j0r1an/diff-poc-deps@0.0.0-stage
Malicious code in @j0r1an/diff-poc-deps (npm)
Analysis
This version of @j0r1an/diff-poc-deps (0.0.0-stage) is a 343-byte name-holding stub: the tarball contains only package.json and README.md, with no JavaScript, no lifecycle hooks, no dependencies and no bin entries. The README describes it as a "Temporary Holding Version" whose operational replacement "has been submitted for review and is awaiting a staged release", and the package description reads "Temporary package placeholder for staged publishing" — i.e. the name is being reserved ahead of a payload publish. Earlier releases under this package name contained executable code. This version itself contains no network indicators, no dropped files, no credential or environment access and no obfuscated content; the record is metadata-only and no IOCs can be attributed to it.
- analyzed by
- Leitwacht
- first seen
- Oct 20, 2026, 12:49 PM
- analyzed
- Oct 20, 2026, 12:49 PM
Related advisories
- casamare@1.0.0
- @platform-services/hrm-mfe-core@99.9.1
- paychex-pdftron@99.9.1
- ccl-global-shopping@99.9.1
- ing-feat-itsme-oidc-authentication@99.9.1
- neverthrow-js@5.5.1
- fanarena-common@99.9.1
- @an1mshnpmb9c84920/stage-outer-m19s5@0.0.0-stage
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.