MAL-2026-16440

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/turbo-ws/MAL-2026-16440.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16440
Published
2026-09-23T01:58:25Z
Modified
2026-09-23T02:30:05Z
Summary
Malicious code in turbo-ws (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67)

package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account (https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz), not a registry version range. npm install fetches whatever bytes that URL currently serves, unpinned and with no integrity check, and runs any lifecycle scripts inside it; the package's postinstall then require()s node-net-pool so its top-level code executes on the installer's machine. The dependency source is under an account unrelated to the declared repository turbo-ws-dev/turbo-ws, and the package's own description advertises 'zero dependencies', contradicting the manifest. Whoever controls the referenced GitHub account controls code executed on every installer of turbo-ws.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020333",
            "import_time":  "2026-09-23T02:26:00.41189189Z",
            "modified_time":  "2026-09-23T01:58:25Z",
            "sha256":  "a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / turbo-ws

Package

Name
turbo-ws
View open source insights on deps.dev
Purl
pkg:npm/turbo-ws

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "7f84ab7675f41e8f3c5dcaac3b100d6c4b427050928faa07470c2880047ad50d",
            "tlsh":  "2031ea2ac9b899bb35c511e4e8195113f66208234998bd00b3c341fc4fce5db91ff5ad"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "turbo-ws-1.0.0.tgz",
            "hashes":  {
                "sha1":  "f00fff966b59f22fa0ff25b60b1243e1dc8a5bc8",
                "sha512_sri":  "sha512-KQ+nijvvuiPSjc9683PuqAC1/FMUgUFvuf7EIi+0al8GW6mpd5wcpC1Z7kUiab0VsXtSqMmMOTxrWTEwVVBu8g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/turbo-ws/MAL-2026-16440.json"