LWA-2026-13238 confirmed malware

dante-watch@0.0.0-stage

Malicious code in dante-watch (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

dante-watch@0.0.0-stage is a name-reservation stub, not a functional package. The tarball contains only package.json and README.md (333 bytes unpacked, two files) with no JavaScript, no lifecycle hooks, no bin entries and no dependencies. The manifest marks itself "stub": true with the description "Temporary package placeholder for staged publishing", and the README states the version is a temporary placeholder for a package whose operational version is awaiting a staged release. The package therefore reserves the dante-watch name ahead of a later release that would carry the actual code. No executable payload, network destination or other IOC is present in this version; the advisory is metadata-only. Consumers should treat any subsequent non-stub release of dante-watch as unvetted code from the same name.

analyzed by
Leitwacht
first seen
Oct 24, 2026, 05:30 PM
analyzed
Oct 24, 2026, 05:31 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.