LWA-2026-13484 confirmed malware

ninjacasino-fi@0.0.0-stage

Malicious code in ninjacasino-fi (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

ninjacasino-fi@0.0.0-stage is an empty placeholder publish: the tarball contains only package.json and README.md (336 bytes unpacked), carries stub:true, and describes itself as a "Temporary package placeholder for staged publishing". It declares no lifecycle hooks, no bin entries, no dependencies and ships no JavaScript, so installing it executes nothing and contacts nothing. No network IOC exists because the package contains no code. It is a reserved name staged ahead of a real payload and should be treated as a precursor to a later, non-stub release under the same name.

analyzed by
Leitwacht
first seen
Oct 30, 2026, 05:56 PM
analyzed
Oct 30, 2026, 05:57 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.