eacq-payform-core@0.0.0-stage

Analysis

eacq-payform-core@0.0.0-stage is a placeholder publish that reserves a package name previously used to ship malicious code. The name is a combosquat: it embeds the real npm package name "payform" intact with an added prefix and suffix. This version contains only package.json and README.md (339 bytes unpacked) — no JavaScript, no lifecycle hooks, no bin entries, no dependencies — so it executes nothing and contains no network indicators. It self-describes as a "Temporary package placeholder for staged publishing" (stub: true) and its README states that "an operational version to replace this has been submitted for review and is awaiting a staged release", i.e. the name is being held ahead of a follow-up release. No IOCs are present in this version; the risk is the staged release that follows under the same name.