MAL-2026-16155

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ultra-ws/MAL-2026-16155.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16155
Published
2026-09-14T17:49:53Z
Modified
2026-09-14T18:30:41Z
Summary
Malicious code in ultra-ws (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08)

package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account (https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz) rather than a registry version range. On npm install, npm fetches whatever bytes that URL currently returns, unpinned and integrity-unchecked, and executes any lifecycle scripts contained in the fetched package. The postinstall script additionally invokes node -e "... require('node-net-pool')...", so the fetched module's top-level code runs in the installer's Node process at install time. The owner account name is a random throwaway-shaped identifier unrelated to any declared publisher, and the branch is mutable so the delivered code can change at any moment without a version bump.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020042",
            "import_time":  "2026-09-14T18:20:58.605887225Z",
            "modified_time":  "2026-09-14T17:49:53Z",
            "sha256":  "a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ultra-ws

Package

Name
ultra-ws
View open source insights on deps.dev
Purl
pkg:npm/ultra-ws

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "29bc89ea037498b214137b8b0358317d24452c0b3b9900fb5dbd357d710a659d",
            "tlsh":  "5e31fb6bcdb8a9bb26d511e8e8165212f66308030918fc08b3c751ac4fce59b81ff66d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "ultra-ws-1.0.0.tgz",
            "hashes":  {
                "sha1":  "9daeb1cf30d6e6d502d720d0b2995317f8b95820",
                "sha512_sri":  "sha512-A5/k5jsk1nUgTawhmcw0rPAL7PnNN3mrjph/YY5QfLHtZM2CAAL2eiC0s3T8UxgeRCe3VzE6/Ww2GswPHGuI0w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ultra-ws/MAL-2026-16155.json"