LWA-2026-13222 confirmed malware

@wardenfeng/cap-tester-server-linux-x64@0.0.0-stage

Malicious code in @wardenfeng/cap-tester-server-linux-x64 (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package is an empty placeholder stub, not a working package. The published tarball is 361 bytes and contains only a package.json ({"stub": true}, no scripts, no bin entries, no dependencies, no main) and a README stating it is a "Temporary Holding Version" placeholder awaiting a staged release. There is no JavaScript, no lifecycle hook, no native binary and no network code, so installing this version executes nothing. The analysis is metadata-only: the package name follows the per-platform binary distribution pattern (@wardenfeng/cap-tester-server-linux-x64, with a darwin-arm64 sibling), but this version ships no payload and has no IOCs to report.

analyzed by
Leitwacht
first seen
Oct 23, 2026, 06:56 AM
analyzed
Oct 23, 2026, 06:56 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.