@wardenfeng/cap-tester-server-linux-x64@0.0.0-stage
Malicious code in @wardenfeng/cap-tester-server-linux-x64 (npm)
Analysis
This package is an empty placeholder stub, not a working package. The published tarball is 361 bytes and contains only a package.json ({"stub": true}, no scripts, no bin entries, no dependencies, no main) and a README stating it is a "Temporary Holding Version" placeholder awaiting a staged release. There is no JavaScript, no lifecycle hook, no native binary and no network code, so installing this version executes nothing. The analysis is metadata-only: the package name follows the per-platform binary distribution pattern (@wardenfeng/cap-tester-server-linux-x64, with a darwin-arm64 sibling), but this version ships no payload and has no IOCs to report.
- analyzed by
- Leitwacht
- first seen
- Oct 23, 2026, 06:56 AM
- analyzed
- Oct 23, 2026, 06:56 AM
Related advisories
- @wardenfeng/cap-tester-server-linux-x64@0.1.1 same package
- @wardenfeng/cap-tester-server-win32-x64@0.1.1
- @wardenfeng/cap-tester-server-win32-x64@0.0.0-stage
- @wardenfeng/cap-tester-server-darwin-arm64@0.0.0-stage
- @ecg-internal/media-util-js-lib@2.0.0
- @ecg-internal/js-react-i18n@1.0.1
- @grabcad/grabcad-shop-shared@1.0.1
- @grabcad/user-license@3.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.