@neodevxsadmd/baileys-api-neko@0.0.0-stage
Malicious code in @neodevxsadmd/baileys-api-neko (npm)
Analysis
This package contains no executable code. The tarball holds only package.json and a README.md — no lifecycle scripts, no bin entries, no dependencies, no main entry point, and no network activity. package.json declares "stub": true with the description "Temporary package placeholder for staged publishing", and the README describes it as a "Temporary Holding Version" awaiting a staged release. It is a name-reservation placeholder: installing it runs nothing and drops nothing. No malicious payload, dropped file, C2 host or other network IOC is present in this version; the analysis is metadata-only because there is no code to inspect.
- analyzed by
- Leitwacht
- first seen
- Oct 25, 2026, 02:20 AM
- analyzed
- Oct 25, 2026, 02:20 AM
Related advisories
- @neodevxsadmd/baileys-api-neko@2.0.3 same package
- @neodevxsadmd/oxlint-config@3.0.0
- @neodevxsadmd/oxlint-config@0.0.0-stage
- jshelperdependenceny@99.0.0
- ionic-insta-api-wrapper@1.2.1
- dante-watch@0.0.0-stage
- @jexkcode/baileys@1.2.0
- swisseph-node@0.0.0-stage
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.