npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware
Severity: critical · Patch status: no-fix-needed · Since 2026-10-25
On 2026-10-25 GitHub published four malware advisories (GHSA-fr38-45mf-vcqf, GHSA-5pw8-3xv5-6cmg, GHSA-4fw4-xm5r-mh69, GHSA-9w8h-674f-4x2j) covering npm packages appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search and appit-cordova-admob. All versions (= 0) are affected, CWE-506 embedded malicious code, no patched versions exist. The advisories state any machine with these packages installed or running should be considered fully compromised, implying credential/key theft and remote control by an outside party. The names mimic legitimate Cordova/Ionic plugins, suggesting a typosquatting or account-compromise campaign targeting Ionic/Cordova developers. No exploitation details or fixed versions are available; removal alone may not eliminate the compromise.
What to do
- Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine
- Remove the packages from all projects and lockfiles and rebuild from a clean environment
- Audit build machines and developer workstations for persistence, unexpected processes and network connections
- Check CI/CD pipelines and published app artifacts for inclusion of these packages and re-sign/rebuild affected apps
- Block these package names in npm dependency policies and review dependency trees for similar typosquats
Sources
All live incidents on Threat Watch
