LWA-2026-13183 confirmed malware

@blueskydataplatform/shared-ui@0.0.0-stage

Malicious code in @blueskydataplatform/shared-ui (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This version of @blueskydataplatform/shared-ui (0.0.0-stage) is an inert placeholder published to hold the package name ahead of a later release. The tarball contains only package.json and README.md — no JavaScript, no lifecycle hooks, no bin entries, no dependencies — and package.json declares "stub": true with the description "Temporary package placeholder for staged publishing". The README states that an operational version "has been submitted for review and is awaiting a staged release". No executable code or network behaviour is present in this version; the package name itself has previously been used to distribute malicious code, and this stub is the staging step for a subsequent payload release under the same name. Treat the package name as untrusted and do not install it.

analyzed by
Leitwacht
first seen
Oct 22, 2026, 11:26 PM
analyzed
Oct 22, 2026, 11:26 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.