{"id":"MAL-2026-16155","summary":"Malicious code in ultra-ws (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08)\npackage.json declares a dependency `node-net-pool` whose source is a tarball URL on the `main` branch of a random third-party GitHub account (`https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz`) rather than a registry version range. On `npm install`, npm fetches whatever bytes that URL currently returns, unpinned and integrity-unchecked, and executes any lifecycle scripts contained in the fetched package. The postinstall script additionally invokes `node -e \"... require('node-net-pool')...\"`, so the fetched module's top-level code runs in the installer's Node process at install time. The owner account name is a random throwaway-shaped identifier unrelated to any declared publisher, and the branch is mutable so the delivered code can change at any moment without a version bump.\n","modified":"2026-09-14T18:30:41.189561043Z","published":"2026-09-14T17:49:53Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020042","import_time":"2026-09-14T18:20:58.605887225Z","modified_time":"2026-09-14T17:49:53Z","sha256":"a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ultra-ws/v/1.0.0"}],"affected":[{"package":{"name":"ultra-ws","ecosystem":"npm","purl":"pkg:npm/ultra-ws"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"29bc89ea037498b214137b8b0358317d24452c0b3b9900fb5dbd357d710a659d","tlsh":"5e31fb6bcdb8a9bb26d511e8e8165212f66308030918fc08b3c751ac4fce59b81ff66d","path":"package.json"}],"package_integrity":[{"filename":"ultra-ws-1.0.0.tgz","hashes":{"sha1":"9daeb1cf30d6e6d502d720d0b2995317f8b95820","sha512_sri":"sha512-A5/k5jsk1nUgTawhmcw0rPAL7PnNN3mrjph/YY5QfLHtZM2CAAL2eiC0s3T8UxgeRCe3VzE6/Ww2GswPHGuI0w=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ultra-ws/MAL-2026-16155.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}