LWA-2026-13221 confirmed malware

@wardenfeng/cap-tester-server-darwin-arm64@0.0.0-stage

Malicious code in @wardenfeng/cap-tester-server-darwin-arm64 (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This version is a non-executable placeholder stub. The tarball contains only two files: a package.json declaring no scripts, no bin entries and no dependencies (marked "stub": true, described as a "Temporary package placeholder for staged publishing"), and a README stating it is a "Temporary Holding Version" awaiting a staged release. There is no JavaScript, no install hook and no network activity in this version. The package name is a platform-specific (darwin-arm64) variant of a name that has previously shipped malicious versions, and the stub is consistent with reserving/staging a package name ahead of a payload release. No IOCs are present in this version because it contains no executable code.

analyzed by
Leitwacht
first seen
Oct 23, 2026, 06:56 AM
analyzed
Oct 23, 2026, 06:56 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.