cursed-modules@0.0.0-stage

Analysis

cursed-modules@0.0.0-stage is a code-free placeholder that reserves the package name for a later staged release. The published tarball contains only package.json and README.md (336 bytes total): no scripts, no lifecycle hooks, no bin entries, no dependencies, no JavaScript, and no network indicators. The manifest describes itself as a "Temporary package placeholder for staged publishing" and sets stub:true, and the README describes the version as a "Temporary Holding Version" whose operational replacement has been submitted for a staged release. No malicious behaviour or IOCs exist in this version. It is flagged because earlier releases of the same package name contained malicious code and this placeholder re-claims the name after those releases were removed from the registry, so the name should be treated as untrusted and any later version published under it should be treated as suspect. Analysis of this version is metadata-only by necessity: there is no executable content to inspect.