Malware in @gocortexio/npmgremlinbox-typosquat-lodash
Malware was distributed via the npm package @gocortexio/npmgremlinbox-typosquat-lodash, a typosquat of lodash. Installation grants full system compromise and requires immediate remediation including credential rotation and package removal.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed
- Ecosystems
- Attack vectors
- Affected entities
- @gocortexio/npmgremlinbox-typosquat-lodash
A malicious npm package named @gocortexio/npmgremlinbox-typosquat-lodash was published, appearing to be a typosquat variant of the popular lodash library. The package contains malware that grants attackers full control of any system on which it is installed.
According to the GitHub Security Advisory (GHSA-2wfp-mw9m-3c6x), any computer with this package installed or running should be considered fully compromised. The advisory recommends immediate rotation of all secrets and keys from a different, uncompromised computer.
While the package should be removed, the advisory notes that full system compromise may have occurred, meaning removal of the package alone may not eliminate all malicious software installed as a result of the initial compromise.
This incident demonstrates the ongoing risk of typosquatting attacks in package ecosystems, where attackers register packages with names similar to legitimate, popular libraries to trick developers into installing malware.
Indicators of compromise
- Packages
- @gocortexio/npmgremlinbox-typosquat-lodash
Remediation
- Immediately identify all systems with @gocortexio/npmgremlinbox-typosquat-lodash installed
- Rotate all secrets, API keys, and credentials from a clean, uncompromised computer
- Remove the malicious package from affected systems
- Perform a full security audit and malware scan on compromised systems
- Review access logs and audit trails for any unauthorized activity during the compromise period
- Consider full system reimaging if the compromise cannot be fully remediated
- Implement package name verification and allowlisting to prevent similar typosquatting attacks
Sources
- GitHub Advisory GHSA-2wfp-mw9m-3c6x · GitHub Advisory Database
Cite this entry
"Malware in @gocortexio/npmgremlinbox-typosquat-lodash." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 20, 2026; last updated July 20, 2026. https://supplychainattack.org/incident/malware-in-gocortexio-npmgremlinbox-typosquat-lodash-1cu9dc
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-moment
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-moment, a typosquatting attack. Systems with this package installed are considered fully compromised and require immediate remediation.
npmTyposquattingCompromised package - containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-axios
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-axios, a typosquat variant. Systems with this package installed are considered fully compromised and require immediate remediation.
npmTyposquattingCompromised package - containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-webpack
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-webpack, a typosquatting attack. Systems with this package installed are considered fully compromised and require immediate remediation.
npmTyposquattingCompromised package - containedcritical
Malware in @gocortexio/npmgremlinbox-typosquat-express
Malware discovered in the npm package @gocortexio/npmgremlinbox-typosquat-express, a typosquatting attack. Systems with this package installed should be considered fully compromised.
npmTyposquattingCompromised package