MAL-2026-19229

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internallib_v647/MAL-2026-19229.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19229
Published
2026-11-13T04:15:52Z
Modified
2026-11-13T04:45:04Z
Summary
Malicious code in internallib_v647 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (701b4c0d503cece80b2a7c5e7e59d1ae5b134b3b801e3ba966f177703917d244)

package.json declares the dependency internallib-helper as a plain-HTTP tarball URL at a bare internal IP: http://10.0.77.5:8000/internallib-helper-1.0.0.tgz. On npm install, npm fetches and installs whatever bytes that endpoint returns and runs any lifecycle scripts contained in the resolved tarball. The source is not the npm registry, there is no version pin, no integrity hash, and no TLS, so the fetched content is unauthenticated and mutable, and any party controlling or able to MITM 10.0.77.5:8000 controls code executed on the installing host. The shipped package source is a minimal stub, so the manifest line itself is the install-time execution vector.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022773",
            "import_time": "2026-11-13T04:36:50.387357003Z",
            "modified_time": "2026-11-13T04:15:52Z",
            "sha256": "701b4c0d503cece80b2a7c5e7e59d1ae5b134b3b801e3ba966f177703917d244",
            "source": "amazon-inspector",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / internallib_v647

Package

Name
internallib_v647
View open source insights on deps.dev
Purl
pkg:npm/internallib_v647

Affected ranges

Affected versions

1.*
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "1d221d14ede075cbec610c37e36acab19bbfecf1495bd4b524d794f3e8fe918d",
            "tlsh": "f7e026300922ac7325c6021a5cb98003b6509e5f09957c0507cb192c84df9f3a9fd34c"
        }
    ],
    "package_integrity": [
        {
            "filename": "internallib_v647-1.0.3.tgz",
            "hashes": {
                "sha1": "4a680d4ccb4cb7fa1757f5fc496641508b46cdc5",
                "sha512_sri": "sha512-YApPUKJ+4h5UV0qAj5rE2JkoUMzlWDFa/C4UzX7bKl+cMepcjxA2lJzgDJFC8zfKDm0vyx5vEznUpR3zd55s7w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/internallib_v647/MAL-2026-19229.json"