// npm package

xarc-webpack-cli

security holding package

npmjs.com tarball repo

versions

maintainers

first publish

2026-05-25

publisher

npm

tarball

438 B

AUTO-PUBLISHED·2 versions indexed·latest published 2026-06-01

// publisher campaignby npm

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @0.0.1-security· no static-pattern hits

@0.0.1-security·2026-06-01·AUTO-PUBLISHED·publisher: npm
heuristic 75/100
static flags 0
llm skipped
new-publisher:19dtiny-tarball:438bfirst-version-of-packageosv-flagged:MAL-2026-4352
// offending code· no static-pattern hits
```
--- package.json (entry) ---
{
  "name": "xarc-webpack-cli",
  "version": "0.0.1-security",
  "description": "security holding package",
  "repository": "npm/security-holder"
}
```
@1.0.0·2026-05-25·AUTO-PUBLISHED·publisher: fais072
heuristic 93/100
static flags 4