The npm package 'haswons' is a typosquatting malware impersonating the legitimate 'hasown' utility. It includes a hidden credential-theft payload executed during installation, which collects extensive system and credential information and exfiltrates it to attacker-controlled servers. This package is part of a broader campaign involving similarly malicious packages sharing the same payload and command-and-control infrastructure.