LWA-2026-13434 confirmed malware

tauri-runtime-electron@0.0.0-stage

Malicious code in tauri-runtime-electron (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

tauri-runtime-electron@0.0.0-stage is an empty placeholder publish: the tarball contains only a package.json marked "stub": true with no scripts, no bin entries and no dependencies, plus a README stating that this is a "temporary holding version" and that an "operational version" has been submitted for a staged release. No executable JavaScript ships in this version, so there is no network indicator of compromise to report. The package name imitates Tauri/Electron ecosystem infrastructure and the version is reserved purely to hold the name; the payload risk lies in the announced replacement version published to this same name, which installs pinned to a lockfile or cached tarball resolve to automatically. Do not use this package name, and treat any later non-placeholder version of tauri-runtime-electron as untrusted until reviewed.

analyzed by
Leitwacht
first seen
Oct 29, 2026, 01:04 PM
analyzed
Oct 29, 2026, 01:04 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.