MAL-2026-16439

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internallib_v550/MAL-2026-16439.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16439
Published
2026-09-23T02:03:28Z
Modified
2026-09-23T02:30:05Z
Summary
Malicious code in internallib_v550 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648)

Package internallib_v550 is named to resemble an internal private library and is published to the public npm registry, matching the classic dependency-confusion squat pattern. Its package.json description is 'pwn'. The single exported function command invokes child_process.exec to spawn /bin/bash -c id and logs the string 'infected' on the consumer host. The payload does not run at install or import time; it fires when consumer code calls the exported function. The name-squat intent, self-labeling as 'pwn', and shell-out on the exported API together form a dependency-confusion attack payload rather than a legitimate library.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020335",
            "import_time":  "2026-09-23T02:26:00.531714226Z",
            "modified_time":  "2026-09-23T02:03:28Z",
            "sha256":  "ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / internallib_v550

Package

Name
internallib_v550
View open source insights on deps.dev
Purl
pkg:npm/internallib_v550

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "270027a438d4db16b0c0b66fb4cec87a5f1f2dd858634ae13d4e6af7ca2f0f22",
            "tlsh":  "04c02b9615fd6538e318f0d07c5bf07578278c20321480f0242c4182118130a519b0ff"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "internallib_v550-1.0.1.tgz",
            "hashes":  {
                "sha1":  "7fa1f66398d08ad5335958774723e448778e6a5f",
                "sha512_sri":  "sha512-e4/nhJTJ73iH0Ffn6Ml9eosknXaCJL8EGSBg6Uz3qArge2qrUxIN93wOWVsPi84LecpNptMFhn3S7vj2Ha5AMw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internallib_v550/MAL-2026-16439.json"