LWA-2026-13242 confirmed malware

@neodevxsadmd/baileys-api-neko@0.0.0-stage

Malicious code in @neodevxsadmd/baileys-api-neko (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package contains no executable code. The tarball holds only package.json and a README.md — no lifecycle scripts, no bin entries, no dependencies, no main entry point, and no network activity. package.json declares "stub": true with the description "Temporary package placeholder for staged publishing", and the README describes it as a "Temporary Holding Version" awaiting a staged release. It is a name-reservation placeholder: installing it runs nothing and drops nothing. No malicious payload, dropped file, C2 host or other network IOC is present in this version; the analysis is metadata-only because there is no code to inspect.

analyzed by
Leitwacht
first seen
Oct 25, 2026, 02:20 AM
analyzed
Oct 25, 2026, 02:20 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.