Fix This Threat

Locate "the malicious package" in your dependency manifest. Verify it's the exact package flagged by the scanner — check for typosquatting variations such as homoglyphs (e.g. Cyrillic "е" instead of Latin "e"), extra characters, or swapped letters.

Search the official npm registry for the legitimate package this was imitating. Check download counts, last publish date, and maintainer reputation before installing.

Remove "the malicious package" from your project. Also manually edit your manifest file to delete any reference to it.

Add the correct package to your manifest as a replacement.

Delete your package-lock.json / yarn.lock and your node_modules directory, then run a fresh install. This ensures no traces of the malicious package — or any files it may have written — remain in your project.

Check for any unexpected changes the malicious package may have introduced: • Modified config files or new scripts • Unexpected network calls in your logs • New environment variables or .env changes • Files that shouldn't exist in your repo

Slopsquatted packages often exfiltrate environment variables on install. Rotate ALL credentials that could have been exposed: • API keys and tokens • Database passwords • Cloud provider credentials • CI/CD secrets and deploy keys Assume worst case — rotate everything that was in the environment while the package was installed.

Run the DevHorrors scanner again on your updated manifest to confirm the malicious package is gone and no new threats were introduced.