LWA-2026-13482 confirmed malware

klikkikasino-fi@0.0.0-stage

Malicious code in klikkikasino-fi (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

This publish (klikkikasino-fi@0.0.0-stage) is an empty placeholder shell: the tarball contains only a package.json declaring "stub": true and "description": "Temporary package placeholder for staged publishing", plus a README saying an "operational version" has been submitted and is awaiting staged release. There is no executable code, no lifecycle hook, no bin entry, no dependency and no network access in this version, and no network IOC exists to report. The analysis is metadata-only: the package reserves the name with version 0.0.0-stage and states that a functional release will follow. Treat the name as hostile-reserved and do not install any later version without review.

analyzed by
Leitwacht
first seen
Oct 30, 2026, 05:34 PM
analyzed
Oct 30, 2026, 05:35 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.