The @dervix/ws npm package is a deliberate typosquatting malicious package that clones the metadata of the legitimate ws WebSocket library to deceive users. Upon requiring the package, it executes obfuscated code that respawns the Node.js process in a detached manner, constructs an AES-256 key from hardcoded buffers, and downloads an encrypted payload from an obfuscated URL. This payload is decrypted and executed with elevated permissions. The use of dynamic imports and runtime checks prevents static detection and debugger analysis. This results in arbitrary attacker-controlled binary code execution on any system that installs and imports the package.

Any system that installs and imports the affected versions of @dervix/ws (=8.21.3 and =8.21.4) is at risk of executing arbitrary malicious code controlled by an attacker. This can lead to full system compromise, persistence via daemonized processes, and potential further payload delivery. The malicious code runs automatically on import, increasing the risk of widespread compromise if the package is used in development or production environments.

No official patch or fix is currently available for this malicious package. The best mitigation is to avoid installing or using the @dervix/ws package entirely. Users should verify package names carefully to avoid typosquatting attacks and prefer the legitimate ws package from the official npm registry. Monitoring for and removing any instances of @dervix/ws in projects is recommended. Since this is a malicious package, remediation involves removal and replacement with the legitimate library rather than patching.