internallib_v23

GHSA-hpq7-6v2v-xmq3

Malicious code in internallib_v23 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36)
index.js line 5 exports a function that invokes /bin/bash to curl https://reverse-shell.sh/10.0.19.80:4443 and pipe the response to a shell, delivering an interactive reverse shell to the hardcoded endpoint 10.0.19.80:4443 on the host where the exported function is called. The destination is a hardcoded private-range IP, there is no authentication, no documentation of the behavior, and the fetched content is executed directly. The package's only exported functionality is this backdoor dropper.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d804cfe9f5aee40bb2d6148df492703641580260/osv/malicious/npm/internallib_v23/MAL-2026-17632.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d804cfe9f5aee40bb2d6148df492703641580260/osv/malicious/npm/internallib_v23/MAL-2026-17632.json
- https://www.npmjs.com/package/internallib_v23/v/1.0.1
- https://github.com/advisories/GHSA-hpq7-6v2v-xmq3

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.