{"id":"MAL-2026-19229","summary":"Malicious code in internallib_v647 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (701b4c0d503cece80b2a7c5e7e59d1ae5b134b3b801e3ba966f177703917d244)\npackage.json declares the dependency `internallib-helper` as a plain-HTTP tarball URL at a bare internal IP: `http://10.0.77.5:8000/internallib-helper-1.0.0.tgz`. On `npm install`, npm fetches and installs whatever bytes that endpoint returns and runs any lifecycle scripts contained in the resolved tarball. The source is not the npm registry, there is no version pin, no integrity hash, and no TLS, so the fetched content is unauthenticated and mutable, and any party controlling or able to MITM 10.0.77.5:8000 controls code executed on the installing host. The shipped package source is a minimal stub, so the manifest line itself is the install-time execution vector.\n","modified":"2026-11-13T04:45:04.232352520Z","published":"2026-11-13T04:15:52Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-13T04:36:50.387357003Z","modified_time":"2026-11-13T04:15:52Z","sha256":"701b4c0d503cece80b2a7c5e7e59d1ae5b134b3b801e3ba966f177703917d244","source":"amazon-inspector","versions":["1.0.3"],"id":"IN-MAL-2026-022773"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/internallib_v647/v/1.0.3"}],"affected":[{"package":{"name":"internallib_v647","ecosystem":"npm","purl":"pkg:npm/internallib_v647"},"versions":["1.0.3"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"f7e026300922ac7325c6021a5cb98003b6509e5f09957c0507cb192c84df9f3a9fd34c","path":"package.json","sha256":"1d221d14ede075cbec610c37e36acab19bbfecf1495bd4b524d794f3e8fe918d"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-YApPUKJ+4h5UV0qAj5rE2JkoUMzlWDFa/C4UzX7bKl+cMepcjxA2lJzgDJFC8zfKDm0vyx5vEznUpR3zd55s7w==","sha1":"4a680d4ccb4cb7fa1757f5fc496641508b46cdc5"},"filename":"internallib_v647-1.0.3.tgz"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internallib_v647/MAL-2026-19229.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}