The internallib_v514 npm package version 1.0.0 exports a function that synchronously executes a shell command using Node.js child_process.execSync. This command downloads a shell script from a hardcoded internal IP address (http://10.0.70.90/rev.sh) via plaintext HTTP and pipes it directly into the shell for execution. The script name suggests a reverse-shell payload, enabling remote code execution. The package does not verify the integrity or authenticity of the downloaded script, lacks TLS encryption, and fetches code from a non-registry, non-publisher endpoint, making any invocation of this function a direct execution of attacker-controlled code.

Any consumer of the internallib_v514 package version 1.0.0 that invokes the exported command function will execute arbitrary code controlled by an attacker. This can lead to full system compromise, including establishing a reverse shell for remote access. The lack of integrity checks and use of plaintext HTTP increases the risk of interception or manipulation of the payload.

No official patch or remediation is currently documented. Users should immediately stop using internallib_v514 version 1.0.0 and remove it from their projects. Avoid invoking the exported command function. Verify dependencies for malicious code and consider using trusted package sources. Monitor for updates or advisories from the package publisher or security community for remediation guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.