LWA-2026-13383 confirmed malware

@azure-growth/signup-ux-components@0.0.0-stage

Malicious code in @azure-growth/signup-ux-components (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

@azure-growth/signup-ux-components@0.0.0-stage is a zero-code placeholder publish, not a functional library. The tarball contains only two files (356 bytes total): a package.json declaring version "0.0.0-stage", "stub": true and description "Temporary package placeholder for staged publishing", and a README stating the version is "a temporary placeholder" while "an operational version to replace this ... is awaiting a staged release". There are no lifecycle scripts, no bin entries, no dependencies and no JavaScript, so nothing executes at install time in this version. The package publishes under an Azure-named scope (@azure-growth) using the "0.0.0-stage" placeholder-version convention, which reserves the package name ahead of a later functional release. No network IOCs are present in this version.

analyzed by
Leitwacht
first seen
Oct 27, 2026, 03:05 PM
analyzed
Oct 27, 2026, 03:05 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.