swisseph-node@0.0.0-stage
Malicious code in swisseph-node (npm)
Analysis
swisseph-node@0.0.0-stage is an inert placeholder publish that reserves a name combosquatting the established `swisseph` package. The tarball contains only package.json and README.md (335 bytes total): no scripts, no bin entries, no JavaScript, no dependencies and no lifecycle hooks, so it executes nothing and has no network IOC. Its own manifest declares "stub": true with the description "Temporary package placeholder for staged publishing", and the README states that an "operational version to replace this has been submitted for review and is awaiting a staged release". The package is therefore a name-reservation step ahead of a staged release under a name that impersonates an established package, and should be treated as a supply-chain staging artifact rather than a usable library.
- analyzed by
- Leitwacht
- first seen
- Oct 24, 2026, 02:25 PM
- analyzed
- Oct 24, 2026, 02:26 PM
Related advisories
- item-validates@1.0.0
- @wardenfeng/cap-tester-server-darwin-x64@0.0.0-stage
- publish-poc-test3@1.0.18
- @wardenfeng/cap-tester-server-win32-x64@0.1.1
- @wardenfeng/cap-tester-server-win32-x64@0.0.0-stage
- @wardenfeng/cap-tester-server-linux-x64@0.1.1
- @wardenfeng/cap-tester-server-darwin-arm64@0.0.0-stage
- @wardenfeng/cap-tester-server-linux-x64@0.0.0-stage
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.