internallib_v550

GHSA-vc8f-vp28-j8g3

Malicious code in internallib_v550 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648)
Package internallib_v550 is named to resemble an internal private library and is published to the public npm registry, matching the classic dependency-confusion squat pattern. Its package.json description is 'pwn'. The single exported function `command` invokes child_process.exec to spawn `/bin/bash -c id` and logs the string 'infected' on the consumer host. The payload does not run at install or import time; it fires when consumer code calls the exported function. The name-squat intent, self-labeling as 'pwn', and shell-out on the exported API together form a dependency-confusion attack payload rather than a legitimate library.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a353b26f444959f921d20700f1f1d31bfa61715d/osv/malicious/npm/internallib_v550/MAL-2026-16439.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/a353b26f444959f921d20700f1f1d31bfa61715d/osv/malicious/npm/internallib_v550/MAL-2026-16439.json
- https://www.npmjs.com/package/internallib_v550/v/1.0.1
- https://github.com/advisories/GHSA-vc8f-vp28-j8g3

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.