LWA-2026-13370 confirmed malware

@drone-js-ext/core@0.0.0-stage

Malicious code in @drone-js-ext/core (npm)

Analysis

This version of @drone-js-ext/core is a name-holding placeholder, not a functional package. The tarball is 340 bytes across two files: a package.json declaring "stub": true with the description "Temporary package placeholder for staged publishing", and a README stating that an operational version "has been submitted for review and is awaiting a staged release". There is no executable code, no preinstall/postinstall or other lifecycle hook, no bin entry, no dependencies and no network access of any kind in this version, so nothing runs on install. The version exists only to reserve the @drone-js-ext/core name ahead of a staged release; the same pattern is used across the @drone-js-ext scope (e.g. @drone-js-ext/vip-badge@0.0.0-stage). Consumers should not treat this version as usable, and should treat any later release under this name as untrusted until reviewed. This analysis is metadata-only: no malicious payload is present in this version to describe.

analyzed by
Leitwacht
first seen
Oct 26, 2026, 04:50 PM
analyzed
Oct 26, 2026, 04:50 PM
weekly installs
797

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.