ultra-ws@1.0.0

Summary

package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account (https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz) rather than a registry version range. On npm install, npm fetches whatever bytes that URL currently returns, unpinned and integrity-unchecked, and executes any lifecycle scripts contained in the fetched package. The postinstall script additionally invokes node -e "... require('node-net-pool')...", so the fetched module's top-level code runs in the installer's Node process at install time. The owner account name is a random throwaway-shaped identifier unrelated to any declared publisher, and the branch is mutable so the delivered code can change at any moment without a version bump.

Source: amazon-inspector (a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08)