Malware in @gocortexio/npmgremlinbox-typosquat-axios
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-axios, a typosquat variant. Systems with this package installed are considered fully compromised and require immediate remediation.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- @gocortexio/npmgremlinbox-typosquat-axios
A malicious npm package named @gocortexio/npmgremlinbox-typosquat-axios was identified and published to the npm registry. The package name appears to be a typosquatting variant designed to deceive developers into installing it instead of a legitimate package.\n\nAccording to the GitHub Security Advisory (GHSA-7j2p-8vwj-g565), any computer with this package installed or running should be considered fully compromised. The malware grants full control of the affected system to an outside entity.\n\nImmediate action is required: all secrets and keys stored on affected computers must be rotated from a different, uncompromised system. While the package should be removed, there is no guarantee that removal will eliminate all malicious software that may have been installed as a result of the initial compromise.
Indicators of compromise
- Packages
- @gocortexio/npmgremlinbox-typosquat-axios
Remediation
- Immediately identify all systems with @gocortexio/npmgremlinbox-typosquat-axios installed
- Isolate affected systems from the network
- Rotate all secrets, API keys, and credentials from a separate, uncompromised computer
- Remove the package from all affected systems
- Conduct a full forensic investigation to identify any additional malware or persistence mechanisms
- Review npm package dependencies and lock files to prevent accidental installation of typosquatted packages
- Implement package name verification and allowlisting in dependency management workflows
Sources
- GitHub Advisory GHSA-7j2p-8vwj-g565 · GitHub Advisory Database
Cite this entry
"Malware in @gocortexio/npmgremlinbox-typosquat-axios." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malware-in-gocortexio-npmgremlinbox-typosquat-axios-84o9x0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-moment
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-moment, a typosquatting attack. Systems with this package installed are considered fully compromised and require immediate remediation.
npmTyposquattingCompromised package - containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-webpack
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-webpack, a typosquatting attack. Systems with this package installed are considered fully compromised and require immediate remediation.
npmTyposquattingCompromised package - resolvedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-lodash
Malware was distributed via the npm package @gocortexio/npmgremlinbox-typosquat-lodash, a typosquat of lodash. Installation grants full system compromise and requires immediate remediation including credential rotation and package removal.
npmTyposquattingCompromised package - containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-express
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-express, a typosquatting attack. Systems with this package installed should be considered fully compromised.
npmTyposquattingCompromised package