LWA-2026-13490 confirmed malware

salettikasino-fi@0.0.0-stage

Malicious code in salettikasino-fi (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

salettikasino-fi@0.0.0-stage is an empty placeholder publication that reserves a package name mimicking the Salettikasino online-casino brand. The tarball contains exactly two files and no executable content: package.json, which declares "stub": true and version "0.0.0-stage" with the description "Temporary package placeholder for staged publishing", and a README stating that an "operational version" has been submitted and is "awaiting a staged release". There is no JavaScript, no bin entry, no lifecycle hook, no dependency and no network code in this version, so the artefact is inert — nothing runs on install or require. The risk it represents is name reservation: an impersonating, brand-recognisable name parked at a stage version in order to publish a live payload later under the same identity. No network IOCs are present in this version.

analyzed by
Leitwacht
first seen
Oct 30, 2026, 06:21 PM
analyzed
Oct 30, 2026, 06:21 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.