LWA-2026-13440 confirmed malware

adyen-web-v6@0.0.0-stage

Malicious code in adyen-web-v6 (npm)

Analysis

This package is an empty placeholder published under a name that imitates Adyen's official browser SDK (the legitimate package is published as @adyen/adyen-web): "adyen-web-v6" reproduces the real product name and appends a version-like suffix. Version 0.0.0-stage contains only package.json and README.md (367 bytes unpacked). The manifest declares "stub": true with the description "Temporary package placeholder for staged publishing", and the README states that an "operational version to replace this has ... been submitted for review and is awaiting a staged release". There is no JavaScript, no bin entry, no lifecycle hook, no dependency and no network endpoint in the tarball, so this version executes nothing and contains no C2 host, URL, IP or dropped-file artifact — it claims the npm name ahead of a later code release. The analysis covers the shipped artifacts only, which are code-free.

analyzed by
Leitwacht
first seen
Oct 29, 2026, 02:51 PM
analyzed
Oct 29, 2026, 02:54 PM

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.