The internallib_v949 npm package version 1.0.3 includes code in index.js that uses child_process.exec to run a bash command which downloads and executes a remote shell script from a hardcoded attacker URL. This opens a reverse shell connection to the attacker's IP 10.0.16.19 on port 443, granting full control over the host. The package declares a self-dependency with a naming pattern consistent with dependency confusion attacks, where an internal package name is squatted on the public npm registry to intercept internal builds. The presence of this package on any system indicates a full compromise.

Systems with internallib_v949 version 1.0.3 installed are fully compromised, as the package grants remote attackers full shell access to the host. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker can execute arbitrary commands with the privileges of the compromised host.

Remove the internallib_v949 package version 1.0.3 immediately. Rotate all secrets and keys that were stored on the compromised system from a separate, trusted environment. Because the attacker may have persistent access, assume full system compromise and consider rebuilding the affected hosts. There is no official patch or fix available. Monitor for any signs of further compromise.