Malicious code in idlive-face-capture-web-development (npm)

[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value a3b620ea8719eae2fa9b62726364bcc9, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (865b0bca2fc5b7c16a7a6cc7b7b1669148b2c5f766cae9a3f43dd78f7427277a)

Package declares scripts.preinstall="node index.js", which on npm install unconditionally issues an HTTPS GET to https://realwbx.com/ip.php with a hardcoded Authorization token, revealing the installer's public IP, User-Agent, and install timing to a third-party host unrelated to the package's declared publisher. Package identity is inconsistent in ways typical of a dependency-confusion/typosquat probe: the package name is idlive-face-capture-web-development, the README body is fiji-core-foundation, the description says "for get the IP location and metadata", and the author (conx3993) and keywords do not correspond to any legitimate face-capture SDK. Installing this package produces an attacker-controlled callback confirming successful execution on the victim host.

Source: ghsa-malware (0f8073c69967080751e6384034553d81b93473b8d4ac2d0aa7f97ba65dbc5cd7)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.