@azure-growth/signup-ux-components@0.0.0-stage
Malicious code in @azure-growth/signup-ux-components (npm)
Analysis
@azure-growth/signup-ux-components@0.0.0-stage is a zero-code placeholder publish, not a functional library. The tarball contains only two files (356 bytes total): a package.json declaring version "0.0.0-stage", "stub": true and description "Temporary package placeholder for staged publishing", and a README stating the version is "a temporary placeholder" while "an operational version to replace this ... is awaiting a staged release". There are no lifecycle scripts, no bin entries, no dependencies and no JavaScript, so nothing executes at install time in this version. The package publishes under an Azure-named scope (@azure-growth) using the "0.0.0-stage" placeholder-version convention, which reserves the package name ahead of a later functional release. No network IOCs are present in this version.
- analyzed by
- Leitwacht
- first seen
- Oct 27, 2026, 03:05 PM
- analyzed
- Oct 27, 2026, 03:05 PM
Related advisories
- @azure-growth/signup-ux-components@2.9.9 same package
- @azure-growth/signup-ux-components@1.2.3 same package
- charape@1.0.1
- charape@1.0.2
- @drone-js-ext/vip-badge@0.0.0-stage
- @zervonex/baileys@3.0.5
- @iobandamwer/cache-helper@1.0.2
- @iobandamwer/cache-helper@1.0.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.