@blueskydataplatform/shared-ui@0.0.0-stage
Malicious code in @blueskydataplatform/shared-ui (npm)
Analysis
This version of @blueskydataplatform/shared-ui (0.0.0-stage) is an inert placeholder published to hold the package name ahead of a later release. The tarball contains only package.json and README.md — no JavaScript, no lifecycle hooks, no bin entries, no dependencies — and package.json declares "stub": true with the description "Temporary package placeholder for staged publishing". The README states that an operational version "has been submitted for review and is awaiting a staged release". No executable code or network behaviour is present in this version; the package name itself has previously been used to distribute malicious code, and this stub is the staging step for a subsequent payload release under the same name. Treat the package name as untrusted and do not install it.
- analyzed by
- Leitwacht
- first seen
- Oct 22, 2026, 11:26 PM
- analyzed
- Oct 22, 2026, 11:26 PM
Related advisories
- @blueskydataplatform/shared-ui@99.0.3 same package
- @blueskydataplatform/shared-ui@0.1.0 same package
- @blueskydataplatform/shared-ui@1.0.1 same package
- @blueskydataplatform/shared-ui@2.0.0 same package
- @blueskydataplatform/shared-ui@2.0.1 same package
- @blueskydataplatform/shared-ui@1.0.0 same package
- @blueskydataplatform/shared-ui@0.0.1 same package
- event-bus-lite-testmetest@0.0.6
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.