MalwarePublished 13 Nov 2026

internallib_v811 (npm) · Malicious Code

Affects internallib_v811Source GCVE Database

Malicious package : remove internallib_v811 and rotate any secrets on hosts that installed it.

Data as of 13 Nov 2026, 05:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-19230

What to do

Remove internallib_v811 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npminternallib_v811	Affected =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The internallib_v811 npm package version 1.0.1 declares a dependency on internallib-helper fetched via an unprotected HTTP URL from a private IP address. This setup allows an attacker with network access to intercept and substitute the tarball during installation, potentially delivering malicious code. The package's index.js is a trivial stub, indicating the install-time code delivery occurs through the dependency declaration itself. This represents a supply chain risk via dependency confusion and insecure transport.

Impact

An attacker with network access to the private IP hosting the dependency can substitute the internallib-helper tarball with malicious code, which npm will install and execute during the package installation process. This can lead to arbitrary code execution on the developer or build environment where the package is installed, potentially compromising systems and downstream software.

Defensive guidance

To mitigate this risk, avoid using dependencies fetched over unencrypted HTTP from private or untrusted sources. Use secure package registries with integrity verification and version pinning. Restrict network access to internal package hosts and consider replacing the dependency with a properly published and verified package. Monitor and audit package.json dependencies for insecure sources.

Summary

The internallib_v811 package version 1.0.1 depends on internallib-helper, which is retrieved from a cleartext HTTP URL pointing to a private IP address rather than a secure registry. Because npm installs the package by fetching the tarball over HTTP without integrity checks or version pinning, an attacker able to intercept traffic to the specified IP and port can replace the tarball with malicious content. The package's own index.js is minimal, implying the main attack vector is the install-time execution of code delivered via the dependency. This scenario exemplifies a supply chain attack leveraging insecure package fetching and dependency confusion.

References

npmjs.com/package/internallib_v811/v/1.0.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Nov 2026, 05:27 UTC

Technical details

References

Community reviews