Fake socket.io and engine.io packages under @dervix and @gleamkit scopes carry malware

July 16, 2026

Five npm packages published on July 13, 2026 impersonate the real-time communication libraries socket.io, engine.io, and ws by placing fake versions under @dervix and @gleamkit scopes. All five return risk_state: critical with supply_chain.compromised: true. No press coverage of this cluster has been found as of publication.

Socket.io and engine.io are the real-time backbone of the Node.js ecosystem. Socket.io runs the WebSocket and polling transport layer behind chat applications, multiplayer games, collaborative tools, financial data feeds, and IoT dashboards at scale. Engine.io is its transport primitive. Anyone building real-time features in Node.js has likely encountered these packages.

The version numbers on the impersonation packages are not random. @dervix/socket.io runs from 4.8.3 through 4.8.9. Real socket.io is in the 4.8.x range. @dervix/engine.io runs from 6.6.2 through 6.6.9. Real engine.io is in the 6.6.x range. A developer scanning a lockfile or a dependency list who sees these packages might reasonably assume they are scoped forks or enterprise distributions of the real libraries. The OSV advisory for @dervix/ws explicitly documents this approach, noting the package copied the real ws library's homepage, repository metadata, and author fields.

What Attestd returns#

curl "https://api.attestd.io/v1/check?product=%40dervix%2Fengine.io&version=6.6.9" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "@dervix/engine.io",
  "version": "6.6.9",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in @dervix/engine.io (npm)",
    "compromised_at": "2026-07-13T19:02:59Z"
  },
  "supply_chain_monitored": true
}

The same shape holds across all five impersonation packages. No CVEs, no vulnerability record. risk_state: critical from the supply chain signal alone.

The core impersonation cluster#

@dervix/ws carries an older compromised_at timestamp of June 26. The @dervix and @gleamkit engine.io and socket.io packages were published in a tight window on July 13 between 19:00 and 19:03 UTC. The three-minute gap between @gleamkit and @dervix publications suggests a coordinated push across two scopes simultaneously.

Two additional packages, node-path-addon and nodemon-async, appear in Attestd's detection cluster on timing proximity but do not share the impersonation naming pattern. Both return risk_state: critical with supply_chain.compromised: true but are not part of the socket.io and engine.io impersonation theme. They are included in the ledger as part of the July 13 detection window and may represent a separate or overlapping campaign.

Why the target is notable#

Previous posts in this ledger have covered attacks targeting blockchain developers, DeFi utility packages, and AsyncAPI tooling. This cluster targets a different and broader developer population. Socket.io claims tens of millions of weekly installs. Engine.io underpins it. Any Node.js developer building anything with real-time features, not just crypto or blockchain, is in scope here.

The scoped package naming convention adds a layer of plausibility that simple typosquatting does not have. @dervix/socket.io reads like an organization distributing a customised version of socket.io, not an obvious fake. A developer who pulls in a scoped socket.io variant from a Copilot or Claude Code suggestion, and does not verify that @dervix is a legitimate organisation, has no strong signal that anything is wrong until the supply chain layer returns compromised.

Attribution#

No attribution has been established. The detection is based on naming pattern and timing correlation in Attestd's supply chain monitoring pipeline. No press coverage or vendor attribution has been found as of July 16, 2026.

Coverage#

All five impersonation packages are covered and return risk_state: critical with supply_chain.compromised: true. Any dependency on @dervix/engine.io, @dervix/socket.io, @dervix/ws, @gleamkit/engine.io, or @gleamkit/socket.io should be treated as a compromised dependency and removed. The real packages are engine.io, socket.io, and ws, all available directly without a scope prefix from their respective maintainers.

API documentation: attestd.io/docs. Detection ledger: github.com/attestd-io/detection-ledger. Machine speed thesis: attestd.io/thesis.