{"id":"GHSA-wm6w-9vgq-gw26","kind":"package","aliases":["GHSA-wm6w-9vgq-gw26","MAL-2026-17896"],"related":[],"title":"Malicious code in xapi-lib (npm)","description":"xapi-lib@88.2.3, 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `fa79878bc2cfb48bd5127ae26fb661b1`, which is the same in all four versions and differs from the value in each of the account's other packages. The npm account conx3993 published xapi-lib on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (beac62be73c115f383ea095cc364879294d6c105817d3c0eb6bfb30ce7bcf46c)\nxapi-lib@88.2.3 declares `preinstall: node index.js` in package.json, and index.js performs an unconditional top-level HTTPS GET to realwbx.com/ip.php (passing `8.8.8.8` and a hardcoded Authorization header) on load. The call fires automatically during `npm install`, sending the installer's source IP to a hardcoded non-publisher endpoint unrelated to any advertised functionality. The package itself is a one-file stub with no library content, so dependency resolution plus the preinstall beacon is the entire effect of installing it. The destination realwbx.com is not a publisher-aligned domain, the request is not caller-configurable, and no documentation discloses the outbound call.\n\n## Source: ghsa-malware (ef93f6ae14f72f3a4d0dfeb7f1e8b859147a54f5458694bc5fd126f7b8aa0592)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"xapi-lib","fixed":[],"affected":"all versions","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-15T13:07:26+00:00","first_seen_at":"2026-11-03T23:14:54+00:00","triaged_at":"2026-11-03T23:16:01+00:00","updated_at":"2026-11-03T23:16:01+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':107C '-10':96C,111C '-15':97C,112C '-17896':15A '-2026':14A '-30':108C '/ip.php':155C '/ip.php?ip=8.8.8.8':58C '2026':95C,106C,110C '8.8.8.8':157C '88.2.3':29C,135C '88.2.5':30C '9':100C '90.2.1':31C '90.3.1':33C '9vgq':11A,19A 'account':82C,88C,104C 'advertis':188C 'align':225C 'amazon':129C 'amazon-inspector':128C 'author':62C,161C 'automat':168C 'beac62be73c115f383ea095cc364879294d6c105817d3c0eb6bfb30ce7bcf46c':131C 'beacon':209C 'call':116C,166C,240C 'caller':232C 'caller-configur':231C 'code':2A 'compromis':259C 'comput':247C,267C,275C,287C 'configur':233C 'consid':257C 'content':202C 'control':284C 'conx3993':89C 'declar':136C 'depend':204C 'describ':34C 'destin':218C 'detail':120C 'differ':74C,274C 'disclos':237C 'document':236C 'domain':226C 'edit':123C 'ef93f6ae14f72f3a4d0dfeb7f1e8b859147a54f5458694bc5fd126f7b8aa0592':245C 'effect':213C 'endpoint':184C 'entir':212C 'entiti':295C 'fa79878bc2cfb48bd5127ae26fb661b1':64C 'file':197C 'fire':167C 'four':71C 'full':283C 'fulli':258C 'function':189C 'get':40C,151C 'ghsa':9A,17A,243C 'ghsa-malwar':242C 'ghsa-wm6w-9vgq-gw26':8A,16A 'given':291C 'guarante':299C 'gw26':12A,20A 'hardcod':61C,160C,180C 'header':162C 'hook':47C,115C 'https':150C 'immedi':271C 'index.js':50C,139C,143C 'inspector':130C 'instal':53C,171C,174C,215C,252C,311C 'ip':41C,177C 'key':263C 'level':149C 'lib':6A,23A,28C,93C,134C 'librari':201C 'line':126C 'load':164C 'locat':42C 'mal':13A 'malici':1A,24B,307C 'malwar':244C 'may':288C 'metadata':44C 'node':49C,138C 'non':182C 'non-publish':181C 'npm':7A,52C,87C,170C 'one':98C,196C 'one-fil':195C 'outbound':239C 'outsid':294C 'packag':25B,38C,85C,101C,191C,251C,277C,303C 'package.json':141C 'pass':156C 'per':118C 'perform':144C 'plus':206C 'preinstal':46C,114C,137C,208C 'publish':90C,183C,224C 'publisher-align':223C 'realwbx.com':57C,117C,154C,219C 'realwbx.com/ip.php':153C 'realwbx.com/ip.php?ip=8.8.8.8':56C 'remov':280C,301C,305C 'request':55C,228C 'resolut':205C 'result':309C 'rotat':270C 'run':48C,254C 'secret':261C 'send':172C 'softwar':308C 'sourc':119C,127C,176C,241C 'store':264C 'stub':198C 'top':148C 'top-level':147C 'uncondit':146C 'unrel':185C 'valu':63C,77C 'version':72C 'whose':113C 'wm6w':10A,18A 'xapi':5A,22A,27C,92C,133C 'xapi-lib':4A,21A,26C,91C,132C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["xapilib"],"ptokens":["lib","xapi"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-10-15T13:07:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17896","url":"https://osv.dev/vulnerability/MAL-2026-17896","severity":"critical","published_at":"2026-10-15T13:07:26+00:00","modified_at":"2026-11-03T22:30:04+00:00","first_seen_at":"2026-11-03T23:14:54+00:00","fetched_at":"2026-11-03T23:14:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}