internallib_v550

{"modified":"2026-09-23T02:03:28Z","published":"2026-09-23T02:03:28Z","schema_version":"1.7.4","id":"MAL-2026-16439","summary":"Malicious code in internallib_v550 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648)\nPackage internallib_v550 is named to resemble an internal private library and is published to the public npm registry, matching the classic dependency-confusion squat pattern. Its package.json description is 'pwn'. The single exported function `command` invokes child_process.exec to spawn `/bin/bash -c id` and logs the string 'infected' on the consumer host. The payload does not run at install or import time; it fires when consumer code calls the exported function. The name-squat intent, self-labeling as 'pwn', and shell-out on the exported API together form a dependency-confusion attack payload rather than a legitimate library.\n","affected":[{"package":{"ecosystem":"npm","name":"internallib_v550"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"270027a438d4db16b0c0b66fb4cec87a5f1f2dd858634ae13d4e6af7ca2f0f22","tlsh":"04c02b9615fd6538e318f0d07c5bf07578278c20321480f0242c4182118130a519b0ff"}],"package_integrity":[{"filename":"internallib_v550-1.0.1.tgz","hashes":{"sha1":"7fa1f66398d08ad5335958774723e448778e6a5f","sha512_sri":"sha512-e4/nhJTJ73iH0Ffn6Ml9eosknXaCJL8EGSBg6Uz3qArge2qrUxIN93wOWVsPi84LecpNptMFhn3S7vj2Ha5AMw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/internallib_v550/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020335","import_time":"2026-09-23T02:26:00.531714226Z","modified_time":"2026-09-23T02:03:28Z","sha256":"ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648","source":"amazon-inspector","versions":["1.0.1"]}]}}