@capsense/core-ui@0.0.0-stage
Malicious code in @capsense/core-ui (npm)
Analysis
@capsense/core-ui@0.0.0-stage is a 339-byte placeholder publish containing only package.json (149 bytes) and README.md (190 bytes): no JavaScript, no lifecycle hooks, no bin entries, no dependencies and no optional dependencies, so installing this exact version executes nothing and produces no network traffic. The manifest sets "stub": true with the description "Temporary package placeholder for staged publishing", and the README states it is a temporary holding version whose operational replacement is awaiting a staged release. No IOCs are present in this version. It is published under a package name whose earlier releases were identified as malicious, and a hollow holding version of this kind keeps the name valid and installable between releases; any subsequent version of @capsense/core-ui should be treated as untrusted until its contents are reviewed.
- analyzed by
- Leitwacht
- first seen
- Oct 29, 2026, 02:51 PM
- analyzed
- Oct 29, 2026, 02:52 PM
Related advisories
browse all confirmed advisories →Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.