npm: Coordinated Typosquat Campaign Drops 25 Malicious Packages in 22 Minutes
On July 31, 2026, 25 malicious npm packages, primarily typosquats targeting popular libraries, were disclosed within a tight 22-minute window, indicating a highly coordinated supply chain attack.
Key findings
- 25 malicious npm packages disclosed on July 31, 2026.
- All advisories published within a 22-minute window.
- Packages primarily used typosquatting to impersonate popular libraries.
- Many packages were newly published just days before disclosure.
- All advisories were rated with Critical severity.
- Notable typosquat
vcsetargeted the popularvueframework.
On July 31, 2026, 25 malicious packages were disclosed on the npm registry within a tight 22-minute window, from 00:30 UTC to 00:52 UTC. This rapid succession of advisories points to a highly coordinated supply chain attack, likely a single takedown effort by security teams. The packages, many of which were newly published just nine days prior to their disclosure, primarily employed typosquatting techniques to impersonate legitimate and widely used npm libraries.
Campaign Pattern: Coordinated Typosquatting
The campaign leveraged typosquatting, a common attack vector where malicious packages are named similarly to popular, legitimate ones to trick developers into installing them. While no single common prefix or scope was identified, the sheer number of packages with slight misspellings of well-known libraries strongly suggests a coordinated effort. Examples include soccketio, socketi, and scketio likely targeting socket.io; passsport1 and passtpor mimicking passport; and moontose and mongostose impersonating mongoose. A particularly notable instance is vcse, a typosquat of the immensely popular vue framework, which draws approximately 14 million weekly downloads. Although the typosquat itself had low download numbers, the targeting of such a high-profile package highlights the potential for widespread impact if the attack had gone unnoticed for longer.
Malicious Behavior
While specific behavioral findings for each package were not detailed, the advisories consistently rated these malicious packages with 'Critical' severity. This classification typically indicates that the packages are designed to achieve significant compromise upon execution. Malicious npm packages often include post-install scripts that execute arbitrary code, exfiltrate sensitive environment variables, steal credentials, or establish persistent backdoors on the compromised system. Given the critical severity, any system that installed these packages should be considered fully compromised.
Severity and Impact
The 'Critical' severity assigned to these advisories means that any system that installed one of these malicious packages should be treated as fully compromised. This level of compromise necessitates immediate and thorough remediation. Developers are advised to assume that sensitive data, including API keys, tokens, and other credentials, may have been exfiltrated. The standard security recommendation in such scenarios is to rotate all secrets from a separate, uncompromised machine.
Detection and Response
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious package names. If found, these packages must be removed, and all associated credentials and tokens should be rotated. Examples of packages to look for include:
asdsafsafdasdsaasdasdasoccketiosocketipasssport1passtporscketiomoontosemongostosesocktiovcse
Additionally, organizations should review their npm token logs for any unauthorized publish events that might indicate a compromised maintainer account, although in this case, the packages appear to be newly registered typosquats rather than account takeovers of existing popular libraries.
Broader Context
This coordinated burst of typosquatting underscores the persistent threat actors pose to the open-source supply chain. The rapid disclosure within minutes suggests that automated detection and response systems are becoming more effective at identifying and removing such threats quickly. However, the continuous emergence of these campaigns highlights the ongoing need for vigilance and robust security practices when integrating third-party dependencies into development workflows.