LWA-2026-13245 confirmed malware

@neodevxsadmd/oxlint-config@3.0.0

Malicious code in @neodevxsadmd/oxlint-config (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This package is a name-reservation staging artifact for the @neodevxsadmd scope. Version 0.0.0-stage ships only two files (package.json and README.md, 349 bytes unpacked) with no executable code: package.json sets "stub": true with the description "Temporary package placeholder for staged publishing", and README.md is titled "Temporary Holding Version" and states that an "operational version to replace this" has been submitted for a staged release. Version 3.0.0 ships four files (7992 bytes) consisting of README.md, LICENSE, package.json and a single oxlint.config.mjs rule table; it declares no lifecycle hooks, no bin entries, and contains no network calls, process execution, environment access, obfuscation or encoded strings. Neither version contains a malicious payload or any network indicator; the package is inert as published and the advisory records the staged placeholder-then-release pattern under this scope.

analyzed by
Leitwacht
first seen
Oct 25, 2026, 02:21 AM
analyzed
Oct 25, 2026, 02:21 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.