ultra-ws@1.0.0

Analysis

ultra-ws@1.0.0 is a Discord-gateway WebSocket client that installs and executes a known-malicious dependency. Its package.json declares the dependency node-net-pool from a non-registry GitHub tarball URL (hxxps://github[.]com/trktgq0wbre1/node-net-pool/archive/refs/heads/main[.]tar[.]gz). The postinstall hook runs `require('node-net-pool')`, and the module entry point also loads node-net-pool at require time, so the malicious dependency is executed both during installation and whenever the package is imported. The dependency is fetched from an arbitrary GitHub repository rather than the npm registry.