Critical Remote Code Execution Vulnerability in internallib_v463 Package
Summary
MAL-2026-16481: Malicious code in internallib_v463 (npm). Affects internallib_v463 versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The internallib_v463 package is an npm module designed for internal use, potentially providing various utility functions. However, it has been compromised to include malicious code that allows an attacker to gain unauthorized access to the host system. This vulnerability is particularly concerning due to its ability to establish a reverse shell, granting full control to the attacker.
Vulnerability Detail
The vulnerability originates from a malicious modification in the internallib_v463 package, specifically in the index.js file. The exported function 'command' executes a command that fetches a reverse shell script from a hardcoded IP address (10.0.73.186:443) and pipes it to the shell. This allows an attacker to gain interactive shell access to the victim's machine. The presence of a console log statement indicating hostile intent further confirms the malicious nature of this code. This vulnerability poses severe risks, including unauthorized access, data theft, and potential system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall internallib_v463If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the internallib_v463 package from your project until a secure version is released. You can do this by executing the following command: npm uninstall internallib_v463. Additionally, consider using a tool like Vulert to monitor your project for vulnerabilities.
Conclusion
The internallib_v463 package contains a critical vulnerability that allows for remote code execution through a reverse shell. It is essential to update or remove this package to protect your systems from potential attacks. Regular monitoring and auditing of dependencies can help prevent similar issues in the future.
See every vulnerability recorded for internallib_v463 →
FAQ
The vulnerability allows for remote code execution through a reverse shell, enabling attackers to gain control over the host system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider removing the package temporarily and monitoring your application for any suspicious activity.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and ensure that you only use trusted packages.
The consequences include unauthorized access to sensitive data, potential data loss, and complete system compromise.
