Critical Malicious Code Vulnerability in internallib_v30 Package
Summary
MAL-2026-17633: Malicious code in internallib_v30 (npm). Affects internallib_v30 versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The internallib_v30 package, available via npm, is designed for internal use but lacks clear documentation and legitimate functionality. Its primary file, index.js, contains malicious code that compromises the security of any system that installs it. The package is suspected to be a target for dependency confusion attacks, given its ambiguous name and empty metadata.
Vulnerability Detail
The vulnerability originates from the internallib_v30 package version 1.0.1, which includes a command in its index.js file that executes a remote shell script from a malicious server. When the exported command() function is invoked, it runs '/bin/bash -c' with a curl command that fetches and executes a script from 'https://reverse-shell.sh/10.0.19.80:8443'. This action opens a reverse shell, allowing attackers to gain unauthorized access to the host system. The lack of legitimate purpose and the presence of embedded malicious code classify this as a severe security threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall internallib_v30If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no direct workarounds for this vulnerability due to the nature of the malicious code. The best approach is to ensure that the internallib_v30 package is not included in your project dependencies.
Conclusion
The internallib_v30 package poses a significant security risk due to its embedded malicious code that can lead to unauthorized access. It is crucial to remove this package from any projects and to monitor for vulnerabilities using tools like Vulert.
See every vulnerability recorded for internallib_v30 →
FAQ
internallib_v30 is an npm package that appears to serve internal purposes but contains malicious code that can compromise system security.
The vulnerability allows an attacker to execute a remote shell script on the host system, opening a reverse shell that grants unauthorized access.
You should uninstall the internallib_v30 package immediately using 'npm uninstall internallib_v30' to protect your system.
Currently, there is no patched version of the internallib_v30 package available, so it is advised to avoid using it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
