MAL-2026-17632

    Dashboard / Malicious Package / MAL-2026-17632

    MAL-2026-17632

    Published: 6 Oct 2026Last Modified: 6 Oct 2026

    Summary: Malicious code in internallib_v23 (npm)

    Details: Source: amazon-inspector (bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36) index.js line 5 exports a function that invokes /bin/bash to curl https://reverse-shell.sh/10.0.19.80:4443 and pipe the response to a shell, delivering an interactive reverse shell to the hardcoded endpoint 10.0.19.80:4443 on the host where the exported function is called. The destination is a hardcoded private-range IP, there is no authentication, no documentation of the behavior, and the fetched content is executed directly. The package's only exported functionality is this backdoor dropper.

    References: https://www.npmjs.com/package/internallib_v23/v/1.0.1

    Affected packages

    Package

    Name: internallib_v23

    Purl: pkg:npm/internallib_v23

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1