Malicious code in ultimate-websocket (npm)
Historical advisory saved 24 Oct 2026 13:17:17 UTC. The publisher may have updated it since then. Latest advisory.
osv · MAL-2026-17529
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114) package.json declares its only dependency `node-net-pool` as a bare tarball URL pointing at the mutable `main` branch of an unrelated GitHub user (`https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz`), bypassing the npm registry entirely. There is no version pin, no commit SHA, and no integrity hash, so `npm install` fetches whatever bytes that URL currently returns and runs any lifecycle scripts contained in them. The package's own `scripts.postinstall` additionally executes `node -e "...require('node-net-pool')..."`, loading the fetched module at install time so its top-level code also runs on the installer's host. The GitHub account is a throwaway-shaped handle unrelated to the publishing identity, and the shipped tarball contains no real functionality — its only install-time effect is to pull and execute attacker-controlled code from an endpoint whose contents the author can change at any time.
- Source published
- 4 Oct 2026 23:24:41 UTC
- Source modified
- 4 Oct 2026 23:45:23 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.