LWA-2026-13443 confirmed malware

ccsseecc-crypto-toolkit@0.0.0-stage

Malicious code in ccsseecc-crypto-toolkit (npm)

Analysis

This version of ccsseecc-crypto-toolkit (0.0.0-stage) is a name-holding stub, not a functioning library: the published tarball contains only package.json and README.md, with package.json declaring "stub": true and describing itself as a "Temporary package placeholder for staged publishing", and the README stating that an "operational version" has been "submitted for review and is awaiting a staged release". The version contains no JavaScript, no lifecycle hooks (no preinstall/postinstall/install), no bin entries, no dependencies, no spawned processes and no network destinations — it executes nothing when installed. The package name is one whose other published versions carry malicious code, so this release functions as a placeholder reserving the namespace ahead of a staged payload release while appearing harmless to scanners that only inspect install behaviour. Analysis of this specific version is metadata-only: there are no code artifacts, C2 hosts, URLs or dropped files to report from it.

analyzed by
Leitwacht
first seen
Oct 29, 2026, 02:51 PM
analyzed
Oct 29, 2026, 02:53 PM

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.