LWA-2026-13439 confirmed malware

@capsense/core-ui@0.0.0-stage

Malicious code in @capsense/core-ui (npm)

Analysis

@capsense/core-ui@0.0.0-stage is a 339-byte placeholder publish containing only package.json (149 bytes) and README.md (190 bytes): no JavaScript, no lifecycle hooks, no bin entries, no dependencies and no optional dependencies, so installing this exact version executes nothing and produces no network traffic. The manifest sets "stub": true with the description "Temporary package placeholder for staged publishing", and the README states it is a temporary holding version whose operational replacement is awaiting a staged release. No IOCs are present in this version. It is published under a package name whose earlier releases were identified as malicious, and a hollow holding version of this kind keeps the name valid and installable between releases; any subsequent version of @capsense/core-ui should be treated as untrusted until its contents are reviewed.

analyzed by
Leitwacht
first seen
Oct 29, 2026, 02:51 PM
analyzed
Oct 29, 2026, 02:52 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.