dante-watch@0.0.0-stage
Malicious code in dante-watch (npm)
Analysis
dante-watch@0.0.0-stage is a name-reservation stub, not a functional package. The tarball contains only package.json and README.md (333 bytes unpacked, two files) with no JavaScript, no lifecycle hooks, no bin entries and no dependencies. The manifest marks itself "stub": true with the description "Temporary package placeholder for staged publishing", and the README states the version is a temporary placeholder for a package whose operational version is awaiting a staged release. The package therefore reserves the dante-watch name ahead of a later release that would carry the actual code. No executable payload, network destination or other IOC is present in this version; the advisory is metadata-only. Consumers should treat any subsequent non-stub release of dante-watch as unvetted code from the same name.
- analyzed by
- Leitwacht
- first seen
- Oct 24, 2026, 05:30 PM
- analyzed
- Oct 24, 2026, 05:31 PM
Related advisories
- @jexkcode/baileys@1.2.0
- swisseph-node@0.0.0-stage
- item-validates@1.0.0
- @wardenfeng/cap-tester-server-darwin-x64@0.0.0-stage
- publish-poc-test3@1.0.18
- @wardenfeng/cap-tester-server-win32-x64@0.1.1
- @wardenfeng/cap-tester-server-win32-x64@0.0.0-stage
- @wardenfeng/cap-tester-server-linux-x64@0.1.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.