MAL-2026-17896

    Dashboard / Malicious Package / MAL-2026-17896

    MAL-2026-17896

    Published: 15 Oct 2026Last Modified: 16 Oct 2026

    Summary: Malicious code in xapi-lib (npm)

    Details: [email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `fa79878bc2cfb48bd5127ae26fb661b1`, which is the same in all four versions and differs from the value in each of the account's other packages. The npm account conx3993 published xapi-lib on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com. Source: amazon-inspector (beac62be73c115f383ea095cc364879294d6c105817d3c0eb6bfb30ce7bcf46c) [email protected] declares `preinstall: node index.js` in package.json, and index.js performs an unconditional top-level HTTPS GET to realwbx.com/ip.php (passing `8.8.8.8` and a hardcoded Authorization header) on load. The call fires automatically during `npm install`, sending the installer's source IP to a hardcoded non-publisher endpoint unrelated to any advertised functionality. The package itself is a one-file stub with no library content, so dependency resolution plus the preinstall beacon is the entire effect of installing it. The destination realwbx.com is not a publisher-aligned domain, the request is not caller-configurable, and no documentation discloses the outbound call.

    References: https://www.npmjs.com/package/xapi-lib, https://www.npmjs.com/package/xapi-lib/v/88.2.5, https://www.npmjs.com/package/xapi-lib/v/88.2.3, https://www.npmjs.com/package/xapi-lib/v/90.3.1, https://www.npmjs.com/package/xapi-lib/v/90.2.1

    Affected packages

    Package

    Name: xapi-lib

    Purl: pkg:npm/xapi-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    88.2.5
    88.2.3