LWA-2026-13116 confirmed malware

@j0r1an/diff-poc-deps@0.0.0-stage

Malicious code in @j0r1an/diff-poc-deps (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This version of @j0r1an/diff-poc-deps (0.0.0-stage) is a 343-byte name-holding stub: the tarball contains only package.json and README.md, with no JavaScript, no lifecycle hooks, no dependencies and no bin entries. The README describes it as a "Temporary Holding Version" whose operational replacement "has been submitted for review and is awaiting a staged release", and the package description reads "Temporary package placeholder for staged publishing" — i.e. the name is being reserved ahead of a payload publish. Earlier releases under this package name contained executable code. This version itself contains no network indicators, no dropped files, no credential or environment access and no obfuscated content; the record is metadata-only and no IOCs can be attributed to it.

analyzed by
Leitwacht
first seen
Oct 20, 2026, 12:49 PM
analyzed
Oct 20, 2026, 12:49 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.