Malicious code in xapi-lib (npm)

[email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which is the same in all four versions and differs from the value in each of the account's other packages. The npm account conx3993 published xapi-lib on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (beac62be73c115f383ea095cc364879294d6c105817d3c0eb6bfb30ce7bcf46c)

[email protected] declares preinstall: node index.js in package.json, and index.js performs an unconditional top-level HTTPS GET to realwbx.com/ip.php (passing 8.8.8.8 and a hardcoded Authorization header) on load. The call fires automatically during npm install, sending the installer's source IP to a hardcoded non-publisher endpoint unrelated to any advertised functionality. The package itself is a one-file stub with no library content, so dependency resolution plus the preinstall beacon is the entire effect of installing it. The destination realwbx.com is not a publisher-aligned domain, the request is not caller-configurable, and no documentation discloses the outbound call.

Source: ghsa-malware (ef93f6ae14f72f3a4d0dfeb7f1e8b859147a54f5458694bc5fd126f7b8aa0592)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.