dsh-taiwind@0.0.0-stage
Malicious code in dsh-taiwind (npm)
Analysis
dsh-taiwind@0.0.0-stage is an inert name-reservation publish, not a functional package. The tarball contains only package/package.json (which declares "stub": true and describes itself as a "Temporary package placeholder for staged publishing") and package/README.md (which states that an operational version "has been submitted for review and is awaiting a staged release"). There are no scripts, no bin entries, no lifecycle hooks, no dependencies and no executable files, so installing it runs nothing. The package name is a misspelling of the well-known tailwind/tailwindcss name with an added "dsh-" prefix, and the accompanying README documents an intent to replace the placeholder with a later staged release — a pattern consistent with reserving a typosquatted name before shipping content under it. No network indicators exist in this version because it contains no code.
- analyzed by
- Leitwacht
- first seen
- Oct 28, 2026, 12:34 PM
- analyzed
- Oct 28, 2026, 12:35 PM
Related advisories
- unbig.js@6.2.13
- unbig.js@6.2.12
- @dcloude/baileys@0.0.9
- @zmtcdn/ui@9999.0.7
- @ifasn/md-doc-mcp@1.0.4
- @ifasn/md-doc-mcp@1.0.3
- @azure-growth/signup-ux-components@0.0.0-stage
- @azure-growth/signup-ux-components@2.9.9
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.