MAL-2026-16439

    Dashboard / Malicious Package / MAL-2026-16439

    MAL-2026-16439

    Published: 23 Sept 2026Last Modified: 23 Sept 2026

    Summary: Malicious code in internallib_v550 (npm)

    Details: Source: amazon-inspector (ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648) Package internallib_v550 is named to resemble an internal private library and is published to the public npm registry, matching the classic dependency-confusion squat pattern. Its package.json description is 'pwn'. The single exported function `command` invokes child_process.exec to spawn `/bin/bash -c id` and logs the string 'infected' on the consumer host. The payload does not run at install or import time; it fires when consumer code calls the exported function. The name-squat intent, self-labeling as 'pwn', and shell-out on the exported API together form a dependency-confusion attack payload rather than a legitimate library.

    References: https://www.npmjs.com/package/internallib_v550/v/1.0.1

    Affected packages

    Package

    Name: internallib_v550

    Purl: pkg:npm/internallib_v550

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1