MAL-2026-19230: Malicious code in internallib_v811 (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (cee312ec1c8c2f9177c54179b22a3f493ba30ee35b5f3c41952b5bdbbfd4eed0) package.json declares the dependency internallib-helper with a source of http://10.0.77.5:8000/internallib-helper-1.0.1.tgz — a plain-HTTP tarball URL on a private IP, not a registry version range. On npm install, npm fetches whatever bytes that host serves and installs them, executing any lifecycle scripts inside the fetched tarball, with no version pin and no integrity check. The transport is cleartext HTTP, so any party able to intercept traffic to 10.0.77.5:8000 can substitute the delivered archive. The shipped index.js is a trivial stub, so the manifest line itself is the install-time code-delivery mechanism. The dependency name internallib-helper closely mirrors the package's own name internallibv811, matching an internal-package / dependency-confusion lure shape.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package?
Any environment that runs npm install for internallib_v811 is exposed, because installation fetches internallib-helper from the configured private-IP HTTP server. This can affect developer workstations and build or deployment systems that install the package.
What does an attacker need to exploit it?
An attacker needs the ability to control the response from 10.0.77.5:8000 or intercept network traffic to that host. Because the archive is fetched over plain HTTP without an integrity check, they can substitute a tarball containing lifecycle scripts.
Is the fetched dependency fixed to a known archive or version?
No. The manifest references a tarball URL rather than a registry version range, and it has no integrity check. Each npm install obtains whatever bytes the server returns at that time.
What can be done if the package cannot be removed immediately?
Avoid running npm install where possible, and prevent access to or interception of traffic to 10.0.77.5:8000. Use only a verified copy of the required dependency archive and eliminate the cleartext network fetch before installing.
How can I identify affected projects?
Inspect package.json files for a dependency named internallib-helper whose source is http://10.0.77.5:8000/internallib-helper-1.0.1.tgz. Projects depending on npm/internallib_v811 should also be reviewed for installs that fetched this archive.