turbo-ws

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67)
package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account (https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz), not a registry version range. npm install fetches whatever bytes that URL currently serves, unpinned and with no integrity check, and runs any lifecycle scripts inside it; the package's postinstall then require()s node-net-pool so its top-level code executes on the installer's machine. The dependency source is under an account unrelated to the declared repository turbo-ws-dev/turbo-ws, and the package's own description advertises 'zero dependencies', contradicting the manifest. Whoever controls the referenced GitHub account controls code executed on every installer of turbo-ws.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a353b26f444959f921d20700f1f1d31bfa61715d/osv/malicious/npm/turbo-ws/MAL-2026-16440.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/a353b26f444959f921d20700f1f1d31bfa61715d/osv/malicious/npm/turbo-ws/MAL-2026-16440.json
- https://www.npmjs.com/package/turbo-ws/v/1.0.0
- https://github.com/advisories/GHSA-49rw-43cc-8cmh

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.