{"id":"MAL-2026-10524","summary":"Malicious code in @velkov/isows (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4fee1d7d5125231d00f9c5f9afe9817b76900ca385b7d077bb4b8bcf3d9ca660)\nPackage is published as `@velkov/isows` while its README, repository (`wevm/isows`), description (\"Isomorphic WebSocket\"), and author (`jxom.eth`) impersonate the legitimate `isows` package. The legitimate upstream `utils.ts` is an 8-line `getNativeWebSocket` helper; in this package, `_cjs/utils.js` and `_esm/utils.js` append ~50KB of obfuscator.io-style payload (rotated string array `a4()`, base64+RC4 decoder `a5()`, debugger-trap class, `while(!![])` loops). The payload runs at top level whenever the package is `require`d or `import`ed (the package.json `main` is `./_cjs/index.js`, which loads `./utils.js`). Behavior: re-execs Node with a sentinel env var, dynamically loads `https`/`fs`/`os`/`child_process`/`path`/`crypto`, issues an HTTPS GET to an RC4-decoded host/path, streams the response to a hostname-derived filename under `os.tmpdir()`, validates a sha256 from a sidecar JSON fetched from the same attacker-controlled host (attacker controls both payload and verification), AES-256-GCM-decrypts the bytes with a key XOR-derived from four embedded 32-byte buffers, `chmod`s 0o755, and `spawn`s the binary `{detached:true, stdio:'ignore', windowsHide:true}` so it survives the parent process. Error-handling stubs are empty to suppress diagnostics. This is the canonical typosquat-plus-dropper supply-chain attack pattern: any installer or transitive consumer that loads `@velkov/isows` runs attacker-controlled native code on their machine.\n","modified":"2026-07-14T04:46:59.206348953Z","published":"2026-07-14T03:36:38Z","database_specific":{"malicious-packages-origins":[{"sha256":"4fee1d7d5125231d00f9c5f9afe9817b76900ca385b7d077bb4b8bcf3d9ca660","source":"amazon-inspector","versions":["1.0.10"],"id":"IN-MAL-2026-010370","import_time":"2026-07-14T04:31:59.35815037Z","modified_time":"2026-07-14T03:36:38Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@velkov/isows/v/1.0.10"}],"affected":[{"package":{"name":"@velkov/isows","ecosystem":"npm","purl":"pkg:npm/%40velkov/isows"},"versions":["1.0.10"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"fdc5094d81fda7473eda1d6fefac929018819ff6fb89ceb89baa75bf5ad396ee","tlsh":"bf931a867edb707f535261f3112b6182e56d9ca9734c8504e162ccecbea423ce3666bc","path":"_cjs/utils.js"}],"package_integrity":[{"filename":"isows-1.0.10.tgz","hashes":{"sha1":"35e17ec507470bbef7f8f848a9e6cf2f401faf7c","sha512_sri":"sha512-MJ0YK7Eyn1VCQaUiLNGFGWWHVZ+8A9PXU50pSqmV0DTUn3hK+iJVSgIzuv1m/iaqR1OjgitUKmAWkgYkKnZtnA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@velkov/isows/MAL-2026-10524.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}