internallib_v550@1.0.1

OSV Malicious Advisory

imported 17d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16439 confirms this npm version as malicious. Package internallib_v550 is named to resemble an internal private library and is published to the public npm registry, matching the classic dependency-confusion squat pattern. Its package.json description is 'pwn'. The single exported function `command` invokes child_process.exec to spawn `/bin/bash -c id` and logs the string 'infected' on the consumer host...

Advisory

MAL-2026-16439

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in internallib_v550 (npm)

Details

Package internallib_v550 is named to resemble an internal private library and is published to the public npm registry, matching the classic dependency-confusion squat pattern. Its package.json description is 'pwn'. The single exported function `command` invokes child_process.exec to spawn `/bin/bash -c id` and logs the string 'infected' on the consumer host. The payload does not run at install or import time; it fires when consumer code calls the exported function. The name-squat intent, self-labeling as 'pwn', and shell-out on the exported API together form a dependency-confusion attack payload rather than a legitimate library.

Decision reason

OpenSSF Malicious Packages via OSV confirms internallib_v550@1.0.1 as malicious (MAL-2026-16439): Malicious code in internallib_v550 (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

internallib_v550@1.0.1

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code