@wardenfeng/cap-tester-server-darwin-arm64@0.0.0-stage
Malicious code in @wardenfeng/cap-tester-server-darwin-arm64 (npm)
Analysis
This version is a non-executable placeholder stub. The tarball contains only two files: a package.json declaring no scripts, no bin entries and no dependencies (marked "stub": true, described as a "Temporary package placeholder for staged publishing"), and a README stating it is a "Temporary Holding Version" awaiting a staged release. There is no JavaScript, no install hook and no network activity in this version. The package name is a platform-specific (darwin-arm64) variant of a name that has previously shipped malicious versions, and the stub is consistent with reserving/staging a package name ahead of a payload release. No IOCs are present in this version because it contains no executable code.
- analyzed by
- Leitwacht
- first seen
- Oct 23, 2026, 06:56 AM
- analyzed
- Oct 23, 2026, 06:56 AM
Related advisories
- @wardenfeng/cap-tester-server-win32-x64@0.1.1
- @wardenfeng/cap-tester-server-win32-x64@0.0.0-stage
- @wardenfeng/cap-tester-server-linux-x64@0.1.1
- @wardenfeng/cap-tester-server-linux-x64@0.0.0-stage
- @ecg-internal/media-util-js-lib@2.0.0
- @ecg-internal/js-react-i18n@1.0.1
- @grabcad/grabcad-shop-shared@1.0.1
- @grabcad/user-license@3.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.