MAL-2026-16102

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15) package.json declares its only runtime dependency as an unpinned GitHub ref (`"node-net-pool": "github:trktgq0wbre1/node-net-pool"`) pointing at a random-handle user account, contradicting the package's own 'Zero runtime dependencies — pure Node.js built-ins only' claim in the README. npm install resolves whatever HEAD of that repository currently returns, and lib/cache.js executes a top-level require of that dependency inside a swallowed try/catch, using the bracketed form `module['require']('node-net-pool')` that evades naive grep for require('node-net-pool'). The README documents an 'Asset prefetch' step in which the loaded dependency resolves a remote endpoint from an internal segment registry, downloads a 'runtime patch asset', and executes it as a detached background worker via child_process.execFile — placing the fetch-and-execute mechanism inside the mutable off-registry dependency that the author can update at any time. The package advertises Discord MFA / vanity-URL sniping, a category where such mislabeled-dependency channels are routinely used to smuggle credential-stealer code.