internallib_v907@1.0.3

Analysis

The package index.js exports a command() function that executes a reverse shell download cradle via child_process.exec: it runs curl against reverse-shell.sh with the IP 10[.]0[.]67[.]6 on port 4444 and pipes the result to sh. The package also ships a .gitlab-ci.yml that runs npm update against a local registry (hxxp://0[.]0[.]0[.]0:4873/) and then executes check.js, which requires the package and calls command(), triggering the reverse shell on CI execution.