@dervix/wsnpm
Malicious code in @dervix/ws (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
Package @dervix/ws impersonates the popular ws WebSocket library — package.json copies the legitimate ws project's homepage (https://github.com/websockets/ws), repository, and author metadata while publishing under an unrelated scope. lib/websocket.js appends ~130KB of heavily obfuscated code after the genuine socketOnError function; this payload executes at require() time via index.js. On import the payload (1) re-spawns the current Node process detached with stdio:'ignore' and windowsHide:true, gated by an obfuscated marker env var so the parent returns cleanly while a daemonized child continues; (2) constructs an AES-256 key by XOR-combining four hardcoded hex Buffers; (3) issues an HTTPS GET (following 3xx redirects) to an encrypted-in-source URL, streams the response to a file under os.tmpdir(), and decrypts it via createDecipheriv; (4) fs.chmodSync(path, 0o755) and child_process.spawn(path,...) with detached:true then unref()s it. Dynamic import('child_process') / import('path') is used to defeat static require audits, and an inspector.url() check short-circuits execution when a debugger is attached. There is no signature verification, no version pinning, and the destination URL is RC4-decoded at runtime so it cannot be inspected statically. Combined with the cloned ws metadata, this is a deliberate typosquat dropper that lands and executes attacker-controlled binary code on any machine that installs and imports the package.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @dervix/ws (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @dervix/ws across your stack and pipelines.
If you installed it — respond
@dervix/ws is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If @dervix/ws was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @dervix/ws before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @dervix/ws-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.