{"id":"MAL-2026-16439","summary":"Malicious code in internallib_v550 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648)\nPackage internallib_v550 is named to resemble an internal private library and is published to the public npm registry, matching the classic dependency-confusion squat pattern. Its package.json description is 'pwn'. The single exported function `command` invokes child_process.exec to spawn `/bin/bash -c id` and logs the string 'infected' on the consumer host. The payload does not run at install or import time; it fires when consumer code calls the exported function. The name-squat intent, self-labeling as 'pwn', and shell-out on the exported API together form a dependency-confusion attack payload rather than a legitimate library.\n","modified":"2026-09-23T02:30:05.477734584Z","published":"2026-09-23T02:03:28Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-020335","import_time":"2026-09-23T02:26:00.531714226Z","modified_time":"2026-09-23T02:03:28Z","sha256":"ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/internallib_v550/v/1.0.1"}],"affected":[{"package":{"name":"internallib_v550","ecosystem":"npm","purl":"pkg:npm/internallib_v550"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"270027a438d4db16b0c0b66fb4cec87a5f1f2dd858634ae13d4e6af7ca2f0f22","tlsh":"04c02b9615fd6538e318f0d07c5bf07578278c20321480f0242c4182118130a519b0ff","path":"index.js"}],"package_integrity":[{"filename":"internallib_v550-1.0.1.tgz","hashes":{"sha512_sri":"sha512-e4/nhJTJ73iH0Ffn6Ml9eosknXaCJL8EGSBg6Uz3qArge2qrUxIN93wOWVsPi84LecpNptMFhn3S7vj2Ha5AMw==","sha1":"7fa1f66398d08ad5335958774723e448778e6a5f"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internallib_v550/MAL-2026-16439.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}