salettikasino-fi@0.0.0-stage
Malicious code in salettikasino-fi (npm)
Analysis
salettikasino-fi@0.0.0-stage is an empty placeholder publication that reserves a package name mimicking the Salettikasino online-casino brand. The tarball contains exactly two files and no executable content: package.json, which declares "stub": true and version "0.0.0-stage" with the description "Temporary package placeholder for staged publishing", and a README stating that an "operational version" has been submitted and is "awaiting a staged release". There is no JavaScript, no bin entry, no lifecycle hook, no dependency and no network code in this version, so the artefact is inert — nothing runs on install or require. The risk it represents is name reservation: an impersonating, brand-recognisable name parked at a stage version in order to publish a live payload later under the same identity. No network IOCs are present in this version.
- analyzed by
- Leitwacht
- first seen
- Oct 30, 2026, 06:21 PM
- analyzed
- Oct 30, 2026, 06:21 PM
Related advisories
- @sakataa/baileys@1.0.0
- ninjacasino-fi@0.0.0-stage
- lumikasino@0.0.0-stage
- klikkikasino-fi@0.0.0-stage
- @axo_cuy/baileyss@3.0.1
- @sakataa/baileys@2.0.0
- claims-acct-unlock@25.2.1
- dependencykfeg@25.1.9
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.