internallib_v756 @1.0.7

Summary

index.js (the package main entry) synchronously invokes execSync to spawn /bin/bash -i with stdio redirected through /dev/tcp/10.0.74.63/4444, opening an interactive reverse shell to a hardcoded remote address whenever the module is loaded. The shell spawn is top-level code, so it fires immediately on require()/import of the package with no gating, granting the operator of 10.0.74.63 interactive command execution on the installer's host.

Source: amazon-inspector (fb9f2ca94c3bf4bd18f73321d08c08130180a3bb66237a4f05f326d0adcf6e06)