The npm package internallib_v234 versions 1.0.3, 1.0.4, 1.0.5, 1.0.6, and 1.0.7 exports a command() function that unconditionally executes a reverse shell command using netcat to connect to a hardcoded RFC1918 IP address (10.0.74.133) on port 13337. Before launching the shell, it verifies netcat presence by running 'whereis nc'. The package exhibits dependency confusion characteristics by mimicking an internal library name, declaring itself as its own dependency, and referencing a private Verdaccio registry in CI configurations. This suggests a targeted attack aiming to trick organizations into installing this malicious public package instead of their internal one, resulting in remote shell access on the installer's host.

If installed and the command() function is invoked, the malicious package opens an interactive reverse shell to an attacker-controlled internal IP address, potentially allowing unauthorized remote code execution and full control over the affected system. This compromises the confidentiality, integrity, and availability of the host machine. The attack relies on the presence of netcat and the invocation of the exported function, so impact depends on usage patterns within the targeted environment.

No official patch or remediation is currently documented. Organizations should avoid installing or invoking the public internallib_v234 package versions 1.0.3 through 1.0.7. Verify and enforce usage of the legitimate internal package from private registries. Review CI configurations to prevent accidental installation from public npm registries. Monitor for unexpected network connections to internal IPs like 10.0.74.133 on port 13337. Patch status is not yet confirmed — check vendor advisories or trusted sources for updates.