turbo-ws@1.0.0

Analysis

turbo-ws@1.0.0 declares a dependency on the package node-net-pool, fetched from a non-registry GitHub tarball URL (github[.]com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz). The postinstall hook executes require('node-net-pool'), so installing turbo-ws installs and runs this external dependency at install time. node-net-pool is a known-malicious package. The dependency is pulled from an unverified GitHub handle rather than the npm registry, bypassing registry provenance checks.