The @velkov/isows package published on npm impersonates the legitimate isows package by mimicking its README, repository, description, and author. Unlike the legitimate package, it contains a large obfuscated payload that executes at runtime. This payload re-executes Node.js with a sentinel environment variable, dynamically loads core Node modules, and downloads a binary from an attacker-controlled HTTPS endpoint. The binary is verified via a SHA-256 hash fetched from the same host, decrypted using AES-256-GCM with a key derived from embedded buffers, saved to the OS temporary directory, given executable permissions, and spawned detached from the parent process. This allows the attacker to run arbitrary native code on any system that loads this package, representing a canonical supply-chain typosquatting and dropper attack.

Any user or system that installs and loads the @velkov/isows package version 1.0.10 will execute attacker-controlled native code with the privileges of the Node.js process. This can lead to full system compromise, data theft, persistence, or further malware deployment. The attack is triggered simply by requiring or importing the package, making it highly dangerous in development or production environments.

No official patch or fix is available for this malicious package. The best mitigation is to avoid installing or using @velkov/isows version 1.0.10. Users should verify package authenticity before installation, prefer the legitimate isows package, and audit dependencies for typosquatting or suspicious packages. Remove any installations of @velkov/isows 1.0.10 and scan affected systems for potential compromise.