LWA-2026-13441 confirmed malware

6161test1234@0.0.0-stage

Malicious code in 6161test1234 (npm)

Analysis

6161test1234@0.0.0-stage is an empty placeholder with no executable content. The published archive holds exactly two files, package.json and README.md, totalling 334 bytes. package.json declares name 6161test1234, version 0.0.0-stage, stub: true and description "Temporary package placeholder for staged publishing"; it declares no scripts block (no preinstall, install or postinstall), no bin entries, no dependencies and no optionalDependencies, so installing it runs nothing. README.md is headed "Temporary Holding Version" and says an operational version to replace it awaits a staged release. No JavaScript exists in the package; no network destination, host, IP, URL or path appears anywhere; no environment variable, token, credential file or user file is read; and nothing is written to disk or registered for persistence. This version therefore has no indicator of compromise. It is an inert name-holding stub, and a later release under the same package name is the expected delivery vehicle for actual content and should be assessed on its own.

analyzed by
Leitwacht
first seen
Oct 29, 2026, 02:51 PM
analyzed
Oct 29, 2026, 02:53 PM
weekly installs
184

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.