lumikasino@0.0.0-stage

Analysis

lumikasino@0.0.0-stage is a placeholder-only publish: the tarball contains just package.json (142 bytes, "stub": true, with no scripts, no bin entries and no dependencies) and a README of 190 bytes stating the version is "a temporary placeholder" for which an "operational version to replace this has been submitted for review and is awaiting a staged release". There is no JavaScript, no lifecycle hook, no install-time code and no network activity in the published artifact — this record is metadata-only: it flags a staged holding publish from a distributing identity whose other packages carry the malicious payload, and the version exists only to claim the name ahead of that staged release. No code-level indicators of compromise can be attributed to this specific version.