Critical Remote Shell Vulnerability in internallib_v657 Package
Summary
MAL-2026-16482: Malicious code in internallib_v657 (npm). Affects internallib_v657 versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The internallib_v657 package is an npm library that has been identified as containing malicious code. It is designed to be a generic package with empty metadata, providing no legitimate functionality. However, it has been exploited to include a backdoor that allows remote command execution on the host machine of any user who installs it.
Vulnerability Detail
The vulnerability originates from the index.js file of the internallib_v657 package, which exports a command function that executes a shell command to download and execute a reverse shell payload from a hardcoded IP address (10.0.73.186:443). This allows an attacker to gain full interactive remote shell access to the victim's machine, leading to arbitrary command execution and potential compromise of sensitive data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall internallib_v657If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of the command function by not invoking it in your code. Additionally, consider using a package manager that can help identify and mitigate vulnerabilities in your dependencies.
Conclusion
The internallib_v657 package contains a critical vulnerability that allows remote command execution through a backdoor. Users are advised to remove the package and monitor their systems for any suspicious activity. Utilizing tools like Vulert can help in identifying such vulnerabilities in real-time.
See every vulnerability recorded for internallib_v657 →
FAQ
The vulnerability allows attackers to execute arbitrary commands on the victim's machine, potentially leading to data theft or system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
Currently, there is no patched version of the internallib_v657 package. It is recommended to remove the package entirely.
If you have installed the internallib_v657 package, immediately uninstall it using the command: npm uninstall internallib_v657.
Regularly audit your dependencies using tools like Vulert and keep your packages updated to their latest versions to minimize security risks.
