MalwarePublished 13 Nov 2026

internallib_v647 (npm) · Malicious Code

Affects internallib_v647Source GCVE Database

Malicious package : remove internallib_v647 and rotate any secrets on hosts that installed it.

Data as of 13 Nov 2026, 05:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-19229

What to do

Remove internallib_v647 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npminternallib_v647	Affected =1.0.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The internallib_v647 npm package version 1.0.3 declares a dependency on internallib-helper via an unauthenticated HTTP tarball URL pointing to a bare internal IP address. This setup allows any party able to intercept or control the HTTP endpoint to deliver arbitrary code that will be executed during npm install, due to lifecycle scripts in the tarball. The package source itself is minimal, making the dependency declaration the primary vector for malicious code execution.

Impact

An attacker controlling or able to intercept traffic to the internal HTTP endpoint can execute arbitrary code on the host machine during npm install. This can lead to compromise of the build or deployment environment, potentially allowing further lateral movement or persistence. The threat is significant because the code execution occurs automatically during package installation without integrity checks or authentication.

Defensive guidance

To mitigate, users should avoid installing internallib_v647 version 1.0.3 or any package that declares dependencies via unauthenticated HTTP URLs to internal IPs. Replace such dependencies with properly sourced packages from trusted registries using HTTPS with integrity verification. Network controls should restrict access to internal package hosting endpoints to trusted parties only. Monitor for updates or advisories from the package maintainers regarding secure dependency declarations.

Summary

The internallib_v647 npm package version 1.0.3 includes a dependency on internallib-helper fetched over plain HTTP from an internal IP address (http://10.0.77.5:8000/internallib-helper-1.0.0.tgz). Because the dependency is not sourced from the npm registry, lacks version pinning, integrity verification, and TLS encryption, the content fetched is unauthenticated and mutable. This allows any attacker with network access to the internal IP or capable of man-in-the-middle attacks to supply malicious code that will be executed on the host during npm install lifecycle scripts. The main package is a minimal stub, so the risk arises primarily from this insecure dependency declaration.

References

npmjs.com/package/internallib_v647/v/1.0.3 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Nov 2026, 05:27 UTC

Technical details

References

Community reviews