@mntv-analysis/workspaces-components@65.11.3
This package is UI WorkSpace Components
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest activates index.js during preinstall, and the entrypoint automatically contacts realwbx.com with a hardcoded Authorization value. This unsolicited install-time network beacon supports blocking publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package runs its preinstall hook, which executes index.js.
Impact
The endpoint receives the installer's network address and the hardcoded request credential without an explicit request by the installer.
Mechanism
Module execution sends an HTTPS request to realwbx.com for a fixed example IP and includes a hardcoded Authorization header.
Attack narrative
Installing the package runs index.js automatically. That file sends an HTTPS request to realwbx.com, includes a hardcoded Authorization value, and makes the request using a fixed example IP. The request exposes the installer's network address to the endpoint without an explicit installer action.
AI rationale
The manifest activates index.js during preinstall, and the entrypoint automatically contacts realwbx.com with a hardcoded Authorization value. This unsolicited install-time network beacon supports blocking publication.
Evidence
package.jsonindex.js
Network endpoints1
realwbx.com/ip.php
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs index.js automatically during preinstall.
- The index.js request targets realwbx.com and asks for information about a supplied IP address.
- The request sends a hardcoded Authorization value to that host.
- The request uses HTTPS, and index.js invokes it with a fixed example IP during module execution.
Evidence against
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg16"scripts": {
"test": "node index.js",
"preinstall": "node index.js"
},
"dependencies": {
"request": "^2.88.2"
High
Ai Review Evidence
The package runs index.js automatically during preinstall.
package.jsonView on unpkg · L16index.jsView file
4const DEFAULT_URL = 'https://realwbx.com/ip.php';
function getPublicIPLocation(ip){
const options = {
hostname: "realwbx.com",
path: `/ip.php?ip=${ip}`,
method:
High
Ai Review Evidence
The index.js request targets realwbx.com and asks for information about a supplied IP address.
index.jsView on unpkg · L4Findings
5 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumStripped Provenance Metadataindex.js
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to @mntv-analysis/workspaces-components@65.11.3.
See all versions of @mntv-analysis/workspaces-components for other recorded verdicts.
- Avoid installing @mntv-analysis/workspaces-components@65.11.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.