@kibt/www-nuxt-i18n@0.0.0-stage
Malicious code in @kibt/www-nuxt-i18n (npm)
Analysis
@kibt/www-nuxt-i18n@0.0.0-stage is a placeholder stub, not a functional package: the published tarball contains only package.json and README.md (341 bytes total) with no JavaScript, no lifecycle scripts, no bin entries and no dependencies, so nothing executes on install. The name is a combosquat of the legitimate nuxt-i18n internationalization module, published under an unrelated scope. The manifest self-declares {"stub": true} with the description "Temporary package placeholder for staged publishing", and the README states that an "operational version to replace this has been submitted for review and is awaiting a staged release" — the shape of a name-reservation stub holding a package name warm ahead of a later payload release. This analysis is metadata-only: this specific version ships no executable code, so there is no network indicator, dropped file or other runtime artefact to report.
- analyzed by
- Leitwacht
- first seen
- Oct 23, 2026, 02:26 AM
- analyzed
- Oct 23, 2026, 02:26 AM
- weekly installs
- 250
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.