MAL-2026-16155
Malicious code in ultra-ws (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08) package.json declares a dependency `node-net-pool` whose source is a tarball URL on the `main` branch of a random third-party GitHub account (`https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz`) rather than a registry version range. On `npm install`, npm fetches whatever bytes that URL currently returns, unpinned and integrity-unchecked, and executes any lifecycle scripts contained in the fetched package. The postinstall script additionally invokes `node -e "... require('node-net-pool')..."`, so the fetched module's top-level code runs in the installer's Node process at install time. The owner account name is a random throwaway-shaped identifier unrelated to any declared publisher, and the branch is mutable so the delivered code can change at any moment without a version bump.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for ultra-ws (npm). Pin to a known-safe version or switch to an alternative.