npm: 40 Malicious '@gocortexio/npmgremlinbox-' Packages Dropped in Coordinated Attack
On July 20, 2026, 40 malicious packages sharing the `@gocortexio` scope and `npmgremlinbox-` prefix were disclosed on npm, all within a single minute, indicating a highly coordinated supply chain attack.
Key findings
- 40 malicious npm packages disclosed within one minute on July 20, 2026.
- All packages share the
@gocortexionpm scope andnpmgremlinbox-prefix. - Package names indicate various malicious behaviors, including C2 communication and credential harvesting.
- The burst includes typosquats targeting popular npm packages like
axiosandlodash. - All packages were first published just one day before their disclosure.
On July 20, 2026, 40 malicious packages were disclosed on the npm registry within a single minute, all sharing the @gocortexio scope and npmgremlinbox- prefix. These packages, first published just one day prior to their disclosure, represent a coordinated supply chain attack designed to inject malicious code into developer environments.
The campaign exhibits a clear naming pattern, with all packages residing under the @gocortexio npm scope and prefixed with npmgremlinbox-. The names themselves suggest various malicious intentions and impersonations. Some packages appear to mimic common open-source licenses, such as @gocortexio/npmgremlinbox-copyleft-next-0-3-0, @gocortexio/npmgremlinbox-mpl-1-1, and @gocortexio/npmgremlinbox-unlicense. Others are explicitly named to indicate malicious functionality, including @gocortexio/npmgremlinbox-malware-c2-beacon, @gocortexio/npmgremlinbox-malware-credential-harvesting, and @gocortexio/npmgremlinbox-malware-cryptomining-indicators. A significant portion of the burst also consists of direct typosquats targeting popular npm packages, such as @gocortexio/npmgremlinbox-typosquat-axios, @gocortexio/npmgremlinbox-typosquat-lodash, and @gocortexio/npmgremlinbox-typosquat-react.
While specific behavioral findings from OpenSSF Package Analysis were not provided, the explicit naming of packages within the burst strongly indicates their intended malicious behaviors. Package names like malware-c2-beacon suggest communication with command-and-control servers, malware-credential-harvesting points to attempts to steal sensitive user credentials, and malware-cryptomining-indicators implies the potential for unauthorized cryptocurrency mining. The presence of malware-install-execution further suggests that these packages are designed to execute arbitrary code upon installation, posing a significant risk to any system that incorporates them.
The nature of these packages implies a severe compromise for any system where they were installed. Developers who may have inadvertently downloaded or integrated these packages should consider their development environments and any associated systems fully compromised. The standard recommendation in such scenarios is to immediately isolate affected systems, rotate all credentials (including API keys, tokens, and passwords) from a separate, clean machine, and thoroughly audit for any unauthorized access or data exfiltration.
Developers should immediately audit their package-lock.json, yarn.lock, or pnpm-lock.yaml files for the presence of any packages under the @gocortexio scope, especially those prefixed with npmgremlinbox-. If found, these packages must be removed, and a comprehensive security review initiated. Examples of packages to look for include: @gocortexio/npmgremlinbox-copyleft-next-0-3-0 @gocortexio/npmgremlinbox-malware-c2-beacon @gocortexio/npmgremlinbox-typosquat-lodash Additionally, organizations should review npm token logs for any unauthorized publish activity that might indicate a compromised maintainer account.
This coordinated drop of 40 malicious npm packages within a minute highlights the ongoing threat of supply chain attacks. The use of a consistent naming scheme, including both license impersonation and direct typosquatting of popular packages, suggests a sophisticated and potentially automated approach by threat actors. The rapid disclosure by security teams underscores the importance of continuous monitoring and swift response mechanisms within the open-source ecosystem to mitigate the impact of such campaigns.