// npm package

@cloudplatform-single-spa/pangolin

security holding package

npmjs.com tarball repo

weekly

111

monthly

111

versions

maintainers

first publish

2026-05-27

publisher

npm

tarball

480 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-28

// publisher campaignby npm

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @0.0.1-security.1· no static-pattern hits

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — no network destinations.

@0.0.1-security.1·2026-05-28·AUTO-PUBLISHED·publisher: npm
heuristic 92/100
static flags 0
llm benign (0.85) via ollama
new-publisher:10dtiny-tarball:480bfirst-version-of-packagepublisher-multi-name-burst:117publisher-version-pump:118osv-flagged:MAL-2026-4959
→ No suspicious destination, no remote-exec shape — no network destinations.
// offending code· no static-pattern hits
```
--- package.json (entry) ---
{
  "name": "@cloudplatform-single-spa/pangolin",
  "version": "0.0.1-security.1",
  "description": "security holding package",
  "repository": "npm/security-holder"
}
```