Malicious Package Affecting typo-crypto package, versions *
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-TYPOCRYPTO-18467865
- published30 Jul 2026
- disclosed27 Jul 2026
- creditCJ Moses
Introduced: 27 Jul 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the typo-crypto package.
Overview
typo-crypto is a malicious package.
This package contains a trojanized core.js file mimicking the legitimate core-js package. The malware activates when it receives a hash input beginning with 0098273, then downloads a second-stage payload from a hardcoded C2 server and runs Windows, macOS, or Linux specific behavior, concealing itself with base64 plus an XOR cipher keyed to 01042025 and maintaining file-based persistence with payload rotation.
Note: This package's malicious behavior may be linked to that of the compromised versions of chalk, debug, and axios.