Malicious Code Vulnerability in Ultimate-Websocket Package
Summary
MAL-2026-17529: Malicious code in ultimate-websocket (npm). Affects ultimate-websocket versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ultimate-websocket is an npm package designed for real-time communication in web applications. It allows developers to implement WebSocket protocols easily, facilitating efficient data transfer between clients and servers. However, this package has been found to contain a serious vulnerability that exposes users to potential malicious code execution.
Vulnerability Detail
The vulnerability originates from the package's dependency on 'node-net-pool', which is fetched from a mutable GitHub tarball URL. This bypasses the npm registry, allowing the installation of arbitrary code without integrity checks. The lack of version pinning or commit SHA means that any changes made to the tarball can introduce malicious code, which is executed during the installation process. This poses a significant risk as it allows attackers to run arbitrary code on the installer's machine, potentially leading to data breaches or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ultimate-websocketIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the ultimate-websocket package until a secure version is released. If you must use it, consider manually reviewing the dependency and its source to ensure no malicious code is present.
Conclusion
The ultimate-websocket package contains a critical vulnerability that allows for the execution of malicious code during installation. Users are advised to update to the latest version or avoid using the package until a fix is implemented. Regular monitoring of dependencies is crucial to maintain application security.
See every vulnerability recorded for ultimate-websocket →
FAQ
The vulnerability allows for the execution of arbitrary code during installation due to a dependency fetched from an untrusted source.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential data breaches, unauthorized access to system resources, and execution of malicious actions on the user's machine.
Yes, temporarily avoid using the package or review its dependencies manually to ensure they are secure.
You can reach out to Amazon Inspector at inspector-research@amazon.com for more details.
