Malicious code in internallib_v514 (npm)

The npm package internallib_v514 was found to contain malicious code in its index.js file. The exported command function calls require('child_process').execSync() to synchronously download and execute a shell script from a hardcoded internal IP address (10.0.70.90) over plaintext HTTP.\n\nThe attack downloads a file named rev.sh from http://10.0.70.90/rev.sh and pipes it directly into sh for execution. The script name and behavior are consistent with a reverse-shell payload, indicating intent to establish unauthorized remote access.\n\nAny application that requires this package and invokes the exported function will execute the attacker-controlled code. The attack provides no integrity verification, no TLS encryption, and no certificate pinning, making it trivial for network-level attackers to intercept or modify the payload.\n\nThe incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-676x-3cvx-w3j5.