Malicious code in internallib_v275 (npm)

The internallib_v275 npm package version 1.0.3 exports a command function that executes a bash command to curl a reverse-shell payload from a hardcoded IP address (10.0.49.106:443) and pipes it to sh, enabling interactive remote shell access on the host. The fetch-and-execute mechanism lacks pinning or hash verification and uses an unauthenticated network connection. The package.json declares a self-referential dependency consistent with dependency confusion attacks targeting internal registries, causing the malicious package to be pulled into internal builds. This results in full compromise of any system with the package installed or running.

Systems with [email protected] installed or running are fully compromised, allowing attackers interactive remote shell access. All secrets and keys on the affected system should be considered exposed and require immediate rotation. Removal of the package does not guarantee complete remediation due to potential persistence of malicious software installed during exploitation.

Immediate removal of the internallib_v275 package version 1.0.3 is recommended. All secrets and keys on affected systems must be rotated from a separate, uncompromised machine. Due to the high likelihood of full system compromise, a full incident response and forensic analysis should be conducted to identify and remove any additional malicious artifacts. No official patch or fix is indicated; remediation relies on removal and secret rotation.