@mntv-analysis/ui
This package is for get the IP location and metadata
This report shows the evidence for @mntv-analysis/ui@99.1.1. 1 of 2 known versions is blocked or flagged. See all versions.
This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe verified install-time request discloses the installer's network address to a fixed external recipient without consent. That automatic installation beacon supports blocking under the installation-beacon policy.
Decision evidence
public snapshot- The package's preinstall hook automatically runs index.js during installation.
- index.js sends a GET request to realwbx.com for a fixed public IP and includes a hardcoded authorization header.
- The install-time request is sent without an installer choice; the endpoint receives the installer's network address although the package describes an IP lookup utility.
- The package describes an IP location and metadata function, and the request queries a fixed public IP; this does not establish collection of local files or credentials.
Source & flagged code
8 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe package's preinstall hook automatically runs index.js during installation.
package.jsonView on unpkg · L12The install-time request is sent without an installer choice; the endpoint receives the installer's network address although the package describes an IP lookup utility.
package.jsonView on unpkg · L2Findings
Affected versions and remediation
This report applies to @mntv-analysis/ui@99.1.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @mntv-analysis/ui@99.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.