Malware in @gocortexio/npmgremlinbox-typosquat-axios
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-axios, a typosquat variant. Systems with this package installed are considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- @gocortexio/npmgremlinbox-typosquat-axios
A malicious npm package named @gocortexio/npmgremlinbox-typosquat-axios was identified and published to the npm registry. The package name appears to be a typosquatting variant designed to deceive developers into installing it instead of a legitimate package.\n\nAccording to the GitHub Security Advisory (GHSA-7j2p-8vwj-g565), any computer with this package installed or running should be considered fully compromised. The malware grants full control of the affected system to an outside entity.\n\nImmediate action is required: all secrets and keys stored on affected computers must be rotated from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the initial compromise.
Indicators of compromise
- Packages
- @gocortexio/npmgremlinbox-typosquat-axios
Remediation
- Immediately identify all systems with @gocortexio/npmgremlinbox-typosquat-axios installed
- Isolate affected systems from the network
- Rotate all secrets, API keys, and credentials from a separate, uncompromised computer
- Remove the package from all affected systems
- Conduct a full forensic investigation to identify any additional malware or persistence mechanisms
- Review npm package dependencies and lock files to prevent accidental installation of typosquatted packages
- Implement package name verification and allowlisting in dependency management workflows
Sources
- GitHub Advisory GHSA-7j2p-8vwj-g565 · GitHub Advisory Database
Cite this entry
"Malware in @gocortexio/npmgremlinbox-typosquat-axios." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malware-in-gocortexio-npmgremlinbox-typosquat-axios-84o9x0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @coralxyz/anchor (npm)
The npm package @coralxyz/anchor is a typosquatting attack impersonating the legitimate @coral-xyz/anchor Solana framework. It contains a postinstall hook that downloads and executes a malicious executable on Windows systems. The package provides no legitimate functionality and serves solely as a dropper for malware.
npmTyposquattingCompromised package - containedcritical
Malicious code in @nestjs-passport/jwt (npm)
A malicious npm package @nestjs-passport/jwt was published under a scope resembling official NestJS packages. The package contains JSFuck-encoded obfuscated code (~2.3MB) that executes hidden functionality at require/import time in the installer's Node process.
npmTyposquattingCompromised package - containedcritical
Malicious code in dolyame-ui-datatable (npm)
The npm package dolyame-ui-datatable contains malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package is a typosquat/dependency-confusion carrier with no legitimate UI or datatable functionality, only loader and dropper code.
npmCompromised packageTyposquatting - activecritical
Malicious code in hardhat-set (npm)
The npm package hardhat-set contains malicious obfuscated code disguised with a copied pino logger README. The package executes a multi-megabyte obfuscated payload on import, delivering hidden malware to anyone who installs or requires it.
npmTyposquattingCompromised package