MAL-2026-19229: Malicious code in internallib_v647 (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (701b4c0d503cece80b2a7c5e7e59d1ae5b134b3b801e3ba966f177703917d244) package.json declares the dependency internallib-helper as a plain-HTTP tarball URL at a bare internal IP: http://10.0.77.5:8000/internallib-helper-1.0.0.tgz. On npm install, npm fetches and installs whatever bytes that endpoint returns and runs any lifecycle scripts contained in the resolved tarball. The source is not the npm registry, there is no version pin, no integrity hash, and no TLS, so the fetched content is unauthenticated and mutable, and any party controlling or able to MITM 10.0.77.5:8000 controls code executed on the installing host. The shipped package source is a minimal stub, so the manifest line itself is the install-time execution vector.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that run npm install for a project using internallib_v647 are exposed if they can reach 10.0.77.5:8000. The dependency is fetched from that internal HTTP endpoint rather than the npm registry.
What does an attacker need to exploit it?
An attacker needs control of, or the ability to intercept traffic to, 10.0.77.5:8000. They can then provide a modified internallib-helper tarball that npm installs and whose lifecycle scripts may execute on the installing host.
Is a normal npm install sufficient to trigger the issue?
Yes. The package manifest declares the dependency as a plain-HTTP tarball URL, and npm install fetches the content returned by that endpoint and can run lifecycle scripts included in the tarball.
How can I determine whether an environment is affected?
Inspect the package.json used by the installation for an internallib-helper dependency pointing to http://10.0.77.5:8000/internallib-helper-1.0.0.tgz. Also determine whether the installing host can reach that address and whether npm install has been run with this manifest.
What can be done before a patch is available?
Prevent npm from retrieving the dependency from the HTTP endpoint, and remove or replace the tarball dependency with a trusted, authenticated source. Restricting access to 10.0.77.5:8000 reduces exposure, but does not authenticate the dependency content.