LWA-2026-13236 confirmed malware

swisseph-node@0.0.0-stage

Malicious code in swisseph-node (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

swisseph-node@0.0.0-stage is an inert placeholder publish that reserves a name combosquatting the established `swisseph` package. The tarball contains only package.json and README.md (335 bytes total): no scripts, no bin entries, no JavaScript, no dependencies and no lifecycle hooks, so it executes nothing and has no network IOC. Its own manifest declares "stub": true with the description "Temporary package placeholder for staged publishing", and the README states that an "operational version to replace this has been submitted for review and is awaiting a staged release". The package is therefore a name-reservation step ahead of a staged release under a name that impersonates an established package, and should be treated as a supply-chain staging artifact rather than a usable library.

analyzed by
Leitwacht
first seen
Oct 24, 2026, 02:25 PM
analyzed
Oct 24, 2026, 02:26 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.