LWA-2026-13405 confirmed malware

dsh-taiwind@0.0.0-stage

Malicious code in dsh-taiwind (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

dsh-taiwind@0.0.0-stage is an inert name-reservation publish, not a functional package. The tarball contains only package/package.json (which declares "stub": true and describes itself as a "Temporary package placeholder for staged publishing") and package/README.md (which states that an operational version "has been submitted for review and is awaiting a staged release"). There are no scripts, no bin entries, no lifecycle hooks, no dependencies and no executable files, so installing it runs nothing. The package name is a misspelling of the well-known tailwind/tailwindcss name with an added "dsh-" prefix, and the accompanying README documents an intent to replace the placeholder with a later staged release — a pattern consistent with reserving a typosquatted name before shipping content under it. No network indicators exist in this version because it contains no code.

analyzed by
Leitwacht
first seen
Oct 28, 2026, 12:34 PM
analyzed
Oct 28, 2026, 12:35 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.