LWA-2026-13224 confirmed malware

@wardenfeng/cap-tester-server-win32-x64@0.0.0-stage

Malicious code in @wardenfeng/cap-tester-server-win32-x64 (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package is an inert placeholder with no executable content. The tarball contains only two files — a README.md and a package.json — totalling 361 bytes. The package.json declares no lifecycle scripts, no bin entries, no dependencies and no optionalDependencies, and the package ships no JavaScript or native binaries, so installing it runs nothing and contacts no network destination. The README describes the version as a "Temporary Holding Version", a placeholder for a package "awaiting a staged release". The package name is platform-specific (@wardenfeng/cap-tester-server-win32-x64) and the version is "0.0.0-stage", consistent with reserving a platform package name ahead of a later release. No malicious behaviour and no network indicators are present in this version; the assessment is metadata-only.

analyzed by
Leitwacht
first seen
Oct 23, 2026, 07:26 AM
analyzed
Oct 23, 2026, 07:26 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.