tauri-runtime-electron@0.0.0-stage
Malicious code in tauri-runtime-electron (npm)
Analysis
tauri-runtime-electron@0.0.0-stage is an empty placeholder publish: the tarball contains only a package.json marked "stub": true with no scripts, no bin entries and no dependencies, plus a README stating that this is a "temporary holding version" and that an "operational version" has been submitted for a staged release. No executable JavaScript ships in this version, so there is no network indicator of compromise to report. The package name imitates Tauri/Electron ecosystem infrastructure and the version is reserved purely to hold the name; the payload risk lies in the announced replacement version published to this same name, which installs pinned to a lockfile or cached tarball resolve to automatically. Do not use this package name, and treat any later non-placeholder version of tauri-runtime-electron as untrusted until reviewed.
- analyzed by
- Leitwacht
- first seen
- Oct 29, 2026, 01:04 PM
- analyzed
- Oct 29, 2026, 01:04 PM
Related advisories
- @zhengliyoux/baileys@1.0.4
- scanstudy-pointer-bat@1.0.0
- @ifasn/mmdd-doc-mcp@1.0.4
- diezyxhao-baileys@1.4.0
- @zaidevx/baileys@1.0.3
- spectral-core@3.0.5
- spectral-core@3.0.6
- @bobfrankston/rmfmail@1.2.364
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.