registry / Malware / @mntv-analysis/ui / 99.1.1

@mntv-analysis/ui@99.1.1

This package is for get the IP location and metadata

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The verified install-time request discloses the installer's network address to a fixed external recipient without consent. That automatic installation beacon supports blocking under the installation-beacon policy.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs its preinstall hook.

Impact

The endpoint can observe the installer's network address during installation; the source does not show credential or local-file collection.

Mechanism

The hook runs index.js, which requests location data for a fixed public IP and includes a hardcoded authorization header.

Attack narrative

The package's preinstall hook runs a network lookup automatically. It contacts realwbx.com for a fixed public IP and includes a hardcoded authorization header, exposing the installer's network address without an install-time choice. The package describes an IP lookup utility, but the fixed lookup is not needed to install it.

AI rationale

Evidence

package.jsonindex.js

Network endpoints1

realwbx.com

Decision evidence

public snapshot

AI called this Malicious at 90.0% confidence as Malware with low false-positive risk.

Evidence for block

The package's preinstall hook automatically runs index.js during installation.
index.js sends a GET request to realwbx.com for a fixed public IP and includes a hardcoded authorization header.
The install-time request is sent without an installer choice; the endpoint receives the installer's network address although the package describes an IP lookup utility.

Evidence against

The package describes an IP location and metadata function, and the request queries a fixed public IP; this does not establish collection of local files or credentials.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.07 KB of source, external domains: realwbx.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-22json

2 "name": "@mntv-analysis/ui",

3 "version": "99.1.1",

4 "description": "This package is for get the IP location and metadata",

High

Ai Review Evidence

The install-time request is sent without an installer choice; the endpoint receives the installer's network address although the package describes an IP lookup utility.

package.jsonView on unpkg · L2

5 "keywords": [

6 "ip"

7 ],

8 "license": "ISC",

9 "author": "conx3993",

10 "type": "commonjs",

11 "main": "index.js",

12 "scripts": {

13 "test": "node index.js",

14 "preinstall": "node index.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 },

16 "dependencies": {

17 "request": "^2.88.2"

High

Suspicious Lifecycle Evidence

The package's preinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L12

18 },

19 "devDependencies": {},

20 "files": ["index.js", "README.md"]

21}

index.jsView file

Lines 1-42javascript

1const https = require('https');

2const { get } = require("request")

5const DEFAULT_URL

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

12"scripts": { "test": "node index.js", "preinstall": "node index.js" }, "dependencies": { "request

High

Suspicious Lifecycle Evidence

The package's preinstall hook automatically runs index.js during installation.

package.jsonView on unpkg · L12

2"name": "@mntv-analysis/ui", "version": "99.1.1", "description": "This package is for get the IP location and metad

High

Ai Review Evidence

The install-time request is sent without an installer choice; the endpoint receives the installer's network address although the package describes an IP lookup utility.

package.jsonView on unpkg · L2

index.jsView file

Findings

4 High5 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.js

MediumNetwork

MediumStripped Provenance Metadataindex.js

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to @mntv-analysis/ui@99.1.1.

See all versions of @mntv-analysis/ui for other recorded verdicts.

Avoid installing @mntv-analysis/ui@99.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 10:46:58.878Z (UTC).

Source advisory published: 2026-10-13 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @mntv-analysis

Other malware packages

Behavioral surface

Source & flagged code

Related packages

More from @mntv-analysis

Other malware packages