npm: 11 Malicious Typosquats Disclosed in Under a Minute
Eleven malicious packages, primarily typosquats impersonating popular libraries, were disclosed on the npm registry within a single minute on July 31, 2026, indicating a rapid, coordinated takedown of newly published threats.
Key findings
- 11 malicious npm packages disclosed within a single minute on July 31, 2026.
- Many packages are typosquats targeting popular libraries like
socket.io,vue,mongoose, andpassport. - All malicious packages were first published just one day before their disclosure.
- The package
vcsetyposquattedvue, which has 14M weekly downloads.
On July 31, 2026, eleven malicious packages were disclosed on the npm registry within a single minute, all at 00:52 UTC. These packages, many appearing to be typosquats of well-known libraries, were all first published just one day prior to their disclosure, suggesting a rapid attack-and-takedown cycle for these fresh threats.
The disclosed packages exhibit a clear pattern of typosquatting, targeting several popular npm libraries. For instance, soccketio, socketi, scketio, and socktio are likely impersonating the widely used socket.io package. Similarly, mongostose and moontose bear a strong resemblance to mongoose, a popular MongoDB object modeling tool. The packages passsport1 and passtpor appear to be typosquats of passport, a common authentication middleware. One package, vcse, directly targets vue, a JavaScript framework with 14 million weekly downloads, highlighting the potential reach of such attacks even when the typosquat itself has low download numbers. Other packages, such as asdsafsafdasdsaasdasda and asdsafsadad, feature alphanumeric noise, which can be indicative of automated generation or an attempt to evade detection.
No specific behavioral findings or severity excerpts were provided for these advisories. However, the nature of typosquatting attacks typically involves the malicious package mimicking the legitimate one while also including code designed to compromise the developer's system. This could range from exfiltrating environment variables and sensitive files to installing backdoors or cryptocurrency miners.
While the exact payload of these specific packages is not detailed, the general threat posed by malicious packages is severe. Any system that installed and executed code from these packages should be considered fully compromised. Such compromises can lead to credential theft, unauthorized access to development environments, and further supply chain attacks. Users are strongly advised to assume a breach and take immediate remediation steps.
Developers should audit their package-lock.json or yarn.lock files for the presence of these malicious package names. If any are found, immediate action is required. This includes rotating all credentials (API keys, tokens, passwords) that may have been exposed on the compromised machine, ideally from a separate, clean system. Additionally, review npm token logs for any unauthorized publish events from your accounts. A representative list of the malicious packages includes:
soccketiosocketiscketiosocktiovcsemongostosemoontosepasssport1passtporasdsafsafdasdsaasdasdaasdsafsadad
This burst of eleven malicious npm packages, rapidly published and subsequently disclosed, underscores the ongoing challenge of typosquatting in package ecosystems. The quick turnaround from publication to disclosure highlights the effectiveness of current detection mechanisms, but also serves as a reminder of the constant vigilance required to protect software supply chains from opportunistic attackers leveraging common human errors.