@wardenfeng/cap-tester-server-win32-x64@0.0.0-stage
Malicious code in @wardenfeng/cap-tester-server-win32-x64 (npm)
Analysis
This package is an inert placeholder with no executable content. The tarball contains only two files — a README.md and a package.json — totalling 361 bytes. The package.json declares no lifecycle scripts, no bin entries, no dependencies and no optionalDependencies, and the package ships no JavaScript or native binaries, so installing it runs nothing and contacts no network destination. The README describes the version as a "Temporary Holding Version", a placeholder for a package "awaiting a staged release". The package name is platform-specific (@wardenfeng/cap-tester-server-win32-x64) and the version is "0.0.0-stage", consistent with reserving a platform package name ahead of a later release. No malicious behaviour and no network indicators are present in this version; the assessment is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Oct 23, 2026, 07:26 AM
- analyzed
- Oct 23, 2026, 07:26 AM
Related advisories
- @wardenfeng/cap-tester-server-win32-x64@0.1.1 same package
- @wardenfeng/cap-tester-server-linux-x64@0.1.1
- @wardenfeng/cap-tester-server-darwin-arm64@0.0.0-stage
- @wardenfeng/cap-tester-server-linux-x64@0.0.0-stage
- @ecg-internal/media-util-js-lib@2.0.0
- @ecg-internal/js-react-i18n@1.0.1
- @grabcad/grabcad-shop-shared@1.0.1
- @grabcad/user-license@3.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.