internallib_v234@1.0.3

Analysis

Package index.js exports a function that executes a reverse shell via child_process.exec: it curls a script from reverse-shell.sh/10[.]0[.]74[.]133:443 and pipes it to sh. The package declares a self-dependency (internallib_v234@^1.0.0) and ships a .gitlab-ci.yml that triggers the payload in CI pipelines by running npm update against a local registry (hxxp://0[.]0[.]0[.]0:4873/) then executing check.js which requires the package and invokes the command. The reverse shell connects to 10[.]0[.]74[.]133:443.