{"id":"MAL-2026-17529","revision":"47aa35ce4fac42bb96b1157f9f73fa2d","records":[{"revision":"47aa35ce4fac42bb96b1157f9f73fa2d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17529","aliases":[],"title":"Malicious code in ultimate-websocket (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114)\npackage.json declares its only dependency `node-net-pool` as a bare tarball URL pointing at the mutable `main` branch of an unrelated GitHub user (`https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz`), bypassing the npm registry entirely. There is no version pin, no commit SHA, and no integrity hash, so `npm install` fetches whatever bytes that URL currently returns and runs any lifecycle scripts contained in them. The package's own `scripts.postinstall` additionally executes `node -e \"...require('node-net-pool')...\"`, loading the fetched module at install time so its top-level code also runs on the installer's host. The GitHub account is a throwaway-shaped handle unrelated to the publishing identity, and the shipped tarball contains no real functionality — its only install-time effect is to pull and execute attacker-controlled code from an endpoint whose contents the author can change at any time.\n","state":0,"publishedAt":"2026-10-04T23:24:41+00:00","modifiedAt":"2026-10-04T23:45:23.8597869+00:00","affected":[{"ecosystem":"npm","name":"ultimate-websocket","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/ultimate-websocket/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17529","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17529","identifiers":["MAL-2026-17529"]},"retained":false,"historicalAffected":[]}],"coverage":[]}