Critical Malicious Code Vulnerability in internallib_v275 Package
Summary
MAL-2026-17510: Malicious code in internallib_v275 (npm). Affects internallib_v275 versions 1.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
internallib_v275 is an npm package that is likely used for internal applications. It is designed to facilitate various functionalities within a software ecosystem. However, it has been identified to contain a significant security vulnerability that allows for the execution of malicious code, potentially compromising the integrity of the host system.
Vulnerability Detail
The vulnerability originates from a malicious code embedded in the internallib_v275 package. Specifically, the index.js file exports a command function that executes a shell command to fetch a reverse-shell payload from a hardcoded external host. This action can lead to an unauthorized interactive remote shell access on the installer host whenever the API is invoked. The lack of hash verification and the use of an unauthenticated network retrieval method exacerbate the risk, making it easy for attackers to exploit this vulnerability.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall internallib_v275If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the internallib_v275 package from your project until a secure version is released. This can be done using the command: npm uninstall internallib_v275. Additionally, ensure that your network policies restrict access to the hardcoded IP address to mitigate potential exploitation.
Conclusion
The internallib_v275 package contains a critical vulnerability that allows for the execution of malicious code, posing a serious risk to systems using it. Immediate action is required to update or remove the package to safeguard against potential exploitation.
See every vulnerability recorded for internallib_v275 →
FAQ
The vulnerability involves malicious code that allows for remote shell access, posing a significant security risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider removing the package temporarily and restricting network access to the hardcoded IP address.
Check the package repository for any updates or patches that address this vulnerability.
Exploitation of this vulnerability can lead to unauthorized access and control over your system, potentially compromising sensitive data.
