# MAL-2026-17529: Malicious code in ultimate-websocket (npm)


- **Type:** Malicious package
- **Package:** `ultimate-websocket` (npm)
- **Published:** 4 Oct 2026

## What is MAL-2026-17529?

MAL-2026-17529 is a malicious package in ultimate-websocket, published on 4 Oct 2026. 

### Official description

package.json declares its only dependency `node-net-pool` as a bare tarball URL pointing at the mutable `main` branch of an unrelated GitHub user (`https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz`), bypassing the npm registry entirely. There is no version pin, no commit SHA, and no integrity hash, so `npm install` fetches whatever bytes that URL currently returns and runs any lifecycle scripts contained in them. The package's own `scripts.postinstall` additionally executes `node -e "...require('node-net-pool')..."`, loading the fetched module at install time so its top-level code also runs on the installer's host. The GitHub account is a throwaway-shaped handle unrelated to the publishing identity, and the shipped tarball contains no real functionality — its only install-time effect is to pull and execute attacker-controlled code from an endpoint whose contents the author can change at any time.

## What should I do about MAL-2026-17529?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17529 is a malicious package: ultimate-websocket (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17529/ (Markdown: https://insights.sbomify.com/MAL-2026-17529/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17529

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17529/
Summaries are generated and may contain mistakes; the official description above is the record.