internallib_v856@99.0.0

Analysis

Package internallib_v856@99.0.0 is a dependency-confusion backdoor targeting internal development pipelines. It was published at version 99.0.0 with a name and "Internal lib for testing" description that mimic a private/internal package, and ships a .gitlab-ci.yml configured to install from a local Verdaccio registry (0[.]0[.]0[.]0:4873) and run check.js, which requires the package and invokes its command() function. The command() function in index.js calls child_process.exec to download and execute a shell script from hxxp://10[.]0[.]0[.]145:8080/shell[.]sh via both curl|bash and wget|bash, logging "VERT16X_PWNED" — a clear second-stage remote shell payload delivered into the CI/CD pipeline or developer environment that imports the package.