Skip to main content
MalwarePublished Updated

internallib_v557 (npm) · Malicious Code

Affects internallib_v557Source GCVE Database

0

Malicious package : remove internallib_v557 and rotate any secrets on hosts that installed it.

Data as of 9 Jul 2026, 09:54 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5678

What to do

Remove internallib_v557 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npminternallib_v557Affected
  • 1.0.1 – 1.0.24
24 affected builds		Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The internallib_v557 npm package contains malicious code that performs a multi-step attack on an internal npm registry. It creates a persistent attacker user, publishes a malicious package version that exfiltrates sensitive data from the root user, and communicates with a hardcoded attacker server. Any system installing or running this package is considered fully compromised.

References

Community reviews

Loading reviews…