LWA-2026-4222 confirmed malware
no-date-parsing@2.2.0
Malicious code in no-date-parsing (npm)
T1195.002 · Compromise Software Supply ChainT1195 · Supply Chain Compromise
Analysis
no-date-parsing@2.2.0 is a typosquat of common date-parsing libraries whose manifest declares dependencies.inline = hxxp://npm[.]artifactsnpm[.]com/npm/no-date-parsing, an HTTP URL pointing to a non-standard, attacker-controlled npm registry. The shipped index.js is a trivial Hello World stub, indicating the real payload is served from that external registry during dependency resolution.
- analyzed by
- Leitwacht
- first seen
- Jun 11, 2026, 09:46 AM
- analyzed
- Jun 11, 2026, 09:47 AM
Related advisories
- firefly-utilities-helper@99.9.1
- optional-cpu-features@1.0.3
- @lekzo/baileys@0.0.1
- bx-ui-view@1.0.0
- @versacode/baileys@1.4.5-beta.1
- @berrysdk/transport@0.1.9
- modules-newline@0.0.6
- @guildai-services/guildai@99.9.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.