Malicious code in internallib_v23 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36) index.js line 5 exports a function that invokes /bin/bash to curl https://reverse-shell.sh/10.0.19.80:4443 and pipe the response to a shell, delivering an interactive reverse shell to the hardcoded endpoint 10.0.19.80:4443 on the host where the exported function is called. The destination is a hardcoded private-range IP, there is no authentication, no documentation of the behavior, and the fetched content is executed directly. The package's only exported functionality is this backdoor dropper.
MAL-2026-17632
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17632
internallib_v23
Source reference: /affected/0/package/name
- Affected versions
- 1.0.1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "internallib_v23",
"purl": "pkg:npm/internallib_v23",
"ecosystem": "npm"
},
"versions": [
"1.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internallib_v23/MAL-2026-17632.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "57c022b7969a022af74961e09e15f861a8478c602a2800b0a014405110c284d32170ff",
"sha256": "114c8a7de3dfb0f039f9f2c1f16c6eaea1a266d75a598a1bfca048e491650e80"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "4c8f6724f47c513fd172699140bf409c8e42ffe7",
"sha512_sri": "sha512-JONfS11/r/G6mT4hmc9HDD9bt0OYK/1w0bpodgpkP3UXTw3KinTAog5n+l3AAW3E6fwP8uiHEzjL+OlFyCBDpA=="
},
"filename": "internallib_v23-1.0.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #86362 · Revision 1
- Added to Heist Feed
- Publisher date