@mntv-analysis/ui-components@50.1.1
This package is for get the IP location and metadata
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe preinstall hook triggers an unsolicited request to a fixed external endpoint, exposing installer network metadata during installation. Although the endpoint partly matches the package’s stated IP-location purpose, the install-time lookup is unnecessary package behavior and supports blocking.
Decision evidence
public snapshot- The preinstall script runs index.js automatically during installation.
- index.js sends an HTTPS request to the fixed realwbx.com endpoint with a hardcoded lookup value.
- The entrypoint invokes the lookup and ends the request without requiring a caller action.
- The package describes itself as providing IP location metadata, which partially aligns with the lookup endpoint.
Source & flagged code
6 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall script runs index.js automatically during installation.
package.jsonView on unpkg · L18index.js sends an HTTPS request to the fixed realwbx.com endpoint with a hardcoded lookup value.
package.jsonView on unpkg · L4Findings
Affected versions and remediation
This report applies to @mntv-analysis/ui-components@50.1.1.
See all versions of @mntv-analysis/ui-components for other recorded verdicts.
- Avoid installing @mntv-analysis/ui-components@50.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.