The internallib_v164 npm package contains malicious code that executes a reverse shell command upon invocation. This command fetches and runs a script from a remote server, opening an interactive shell to a hardcoded internal network address. This behavior grants an attacker arbitrary code execution and persistent access on the host machine. The affected package versions include 6.0.9, 4.0.9, 1.0.7, and 1.0.9. Removal of the package alone may not fully remediate the compromise, as the attacker may have already established persistent control. Immediate secret and key rotation from a different, uncompromised system is strongly advised.