@neodevxsadmd/oxlint-config@3.0.0
Malicious code in @neodevxsadmd/oxlint-config (npm)
Analysis
This package is a name-reservation staging artifact for the @neodevxsadmd scope. Version 0.0.0-stage ships only two files (package.json and README.md, 349 bytes unpacked) with no executable code: package.json sets "stub": true with the description "Temporary package placeholder for staged publishing", and README.md is titled "Temporary Holding Version" and states that an "operational version to replace this" has been submitted for a staged release. Version 3.0.0 ships four files (7992 bytes) consisting of README.md, LICENSE, package.json and a single oxlint.config.mjs rule table; it declares no lifecycle hooks, no bin entries, and contains no network calls, process execution, environment access, obfuscation or encoded strings. Neither version contains a malicious payload or any network indicator; the package is inert as published and the advisory records the staged placeholder-then-release pattern under this scope.
- analyzed by
- Leitwacht
- first seen
- Oct 25, 2026, 02:21 AM
- analyzed
- Oct 25, 2026, 02:21 AM
Related advisories
- @neodevxsadmd/oxlint-config@0.0.0-stage same package
- @neodevxsadmd/baileys-api-neko@2.0.3
- @neodevxsadmd/baileys-api-neko@0.0.0-stage
- jshelperdependenceny@99.0.0
- ionic-insta-api-wrapper@1.2.1
- dante-watch@0.0.0-stage
- @jexkcode/baileys@1.2.0
- swisseph-node@0.0.0-stage
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.