{"id":"MAL-2026-17895","kind":"package","aliases":["MAL-2026-17895"],"related":[],"title":"Malicious code in web-pixels-manager (npm)","description":"web-pixels-manager@76.2.4 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `207e4133bd083b9e3e89c5556fc8677e`, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a75cc1a77f4f7dce3f84c9b66aa2613ace8bccab0fffa5587a4a30ce9fdc71a)\nPackage name `web-pixels-manager` typosquats Shopify's scoped `@shopify/web-pixels-manager`; the stated description (`get the IP location and metadata`) is unrelated to that name and the README is a one-line stub. `package.json` declares `preinstall: node index.js`, and `index.js` executes top-level code on `npm install` that performs an HTTPS GET to `https://realwbx.com/ip.php` with a hardcoded `Authorization` bearer token (via `getPublicIPLocation('8.8.8.8')`). The destination is not a Shopify or publisher-matching host. The install-time outbound call allows the operator of realwbx.com to enumerate hosts that installed the package, timestamp them, and correlate them to the hardcoded token, providing a victim check-in channel under a typosquatted name.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"web-pixels-manager","fixed":[],"affected":"= 76.2.4","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-15T13:01:07+00:00","first_seen_at":"2026-10-26T20:51:54+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':90C '-10':79C,94C '-15':80C,95C '-17895':11A,14A '-2026':10A,13A '-30':91C '/ip.php':172C '/ip.php?ip=8.8.8.8':50C '2026':78C,89C,93C '207e4133':56C '2a75cc1a77f4f7dce3f84c9b66aa2613ace8bccab0fffa5587a4a30ce9fdc71a':114C '76.2.4':25C '8.8.8.8':181C '9':83C 'account':67C,73C,87C 'allow':199C 'amazon':112C 'amazon-inspector':111C 'author':54C,176C 'bd083b9e3e89c5556fc8677e':57C 'bearer':177C 'call':99C,198C 'channel':226C 'check':224C 'check-in':223C 'code':2A,160C 'conx3993':74C 'correl':214C 'declar':150C 'describ':26C 'descript':128C 'destin':183C 'detail':103C 'differ':59C 'edit':106C 'enumer':205C 'execut':156C 'get':32C,129C,168C 'getpubliciploc':180C 'hardcod':53C,175C,218C 'hook':39C,98C 'host':192C,206C 'https':167C 'index.js':42C,153C,155C 'inspector':113C 'instal':45C,163C,195C,208C 'install-tim':194C 'ip':33C,131C 'level':159C 'line':109C,147C 'locat':34C,132C 'mal':9A,12A 'malici':1A,19B 'manag':7A,24C,120C 'manager':18A 'match':191C 'metadata':36C,134C 'name':116C,139C,230C 'node':41C,152C 'npm':8A,44C,72C,162C 'one':81C,146C 'one-lin':145C 'oper':201C 'outbound':197C 'packag':20B,30C,70C,84C,115C,210C 'package.json':149C 'per':101C 'perform':165C 'pixel':6A,23C,119C 'pixels':17A 'preinstal':38C,97C,151C 'provid':220C 'publish':75C,190C 'publisher-match':189C 'readm':142C 'realwbx.com':49C,100C,171C,203C 'realwbx.com/ip.php':170C 'realwbx.com/ip.php?ip=8.8.8.8':48C 'request':47C 'run':40C 'scope':124C 'shopifi':122C,187C 'shopify/web-pixels-manager':125C 'sourc':102C,110C 'state':127C 'stub':148C 'time':196C 'timestamp':211C 'token':178C,219C 'top':158C 'top-level':157C 'typosquat':121C,229C 'unrel':136C 'valu':55C,62C 'via':179C 'victim':222C 'web':5A,16A,22C,118C 'web-pixels-manag':4A,21C,117C 'web-pixels-manager':15A 'whose':96C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T13:01:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17895","url":"https://osv.dev/vulnerability/MAL-2026-17895","severity":"critical","published_at":"2026-10-15T13:01:07+00:00","modified_at":"2026-10-26T06:45:15+00:00","first_seen_at":"2026-10-26T20:51:54+00:00","fetched_at":"2026-10-26T20:51:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}