The @gleamkit/ws package version 8.21.3 is a malicious npm package designed to masquerade as the legitimate ws package by duplicating its description, homepage, repository, author, and README. It bundles the genuine ws source code but appends a heavily obfuscated payload in lib/websocket.js. This payload reconstructs runtime data to fetch an external binary over HTTPS, decrypts it using AES-256-GCM, writes it to the OS temporary directory, sets executable permissions, and spawns it as a detached child process with hidden windows. The process then exits immediately. This execution is triggered simply by requiring or importing the package, causing any project that loads @gleamkit/ws to run attacker-controlled code.

Any project that installs and loads the malicious @gleamkit/ws package version 8.21.3 will execute attacker-controlled code fetched remotely at runtime. This can lead to arbitrary code execution on the host system, potentially compromising confidentiality, integrity, and availability of the affected environment.

No official patch or remediation is currently documented. Users should immediately remove the @gleamkit/ws package version 8.21.3 from their projects and avoid installing or loading this package. Verify dependencies to ensure this malicious package is not present. Monitor for updates from the npm registry or relevant security advisories for any official remediation or replacement guidance. Since this is a malicious package impersonating a legitimate one, rely on trusted package sources and verify package integrity before installation.