registry / Malware / @user-interface-common/common-styles

@user-interface-common/common-styles

This package is for get the IP location and metadata

This report shows the evidence for @user-interface-common/common-styles@66.1.6. 1 of 2 known versions is blocked or flagged. See all versions.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The active preinstall request is unnecessary to install a common styles package and runs without user action, disclosing the installer’s network origin to a fixed recipient. The package’s stated lookup functionality does not establish consent for this automatic install-time request.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs its preinstall script.

Impact

The installation discloses the installer’s network origin to a fixed remote recipient without an affirmative action or consent guard.

Mechanism

The entrypoint sends an HTTPS request to realwbx.com for the fixed IP address 8.8.8.8; the remote service also sees the connection's network origin.

Attack narrative

During installation, the preinstall hook runs an example lookup for a fixed public IP at realwbx.com. The request includes a hardcoded authorization value and exposes the installer’s network origin to the fixed recipient without a consent check.

AI rationale

Evidence

package.jsonindex.js

Network endpoints1

realwbx.com

Decision evidence

public snapshot

AI called this Malicious at 92.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall script automatically runs index.js during installation.
index.js targets realwbx.com and requests location data for a supplied IP.
The request uses a hardcoded authorization value and sends an HTTPS request.
The entrypoint automatically looks up the fixed address 8.8.8.8 without a user action or consent check.

Evidence against

The package describes IP lookup functionality and exports a lookup helper, but the install hook invokes a fixed example automatically.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.11 KB of source, external domains: realwbx.com

Source & flagged code

7 flagged

package.jsonView file

Lines 1-25json

2 "name": "@user-interface-common/common-styles",

3 "version": "66.1.6",

4 "description": "This package is for get the IP location and metadata",

5 "keywords": [

6 "ip"

7 ],

8 "license": "ISC",

9 "author": "conx3993",

10 "type": "commonjs",

11 "main": "index.js",

12 "files": [

13 "index.js",

14 "README.md"

15 ],

16 "scripts": {

17 "test": "node index.js",

18 "preinstall": "node index.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "dependencies": {

High

Ai Review Evidence

The preinstall script automatically runs index.js during installation.

package.jsonView on unpkg · L16

21 "request": "^2.88.2"

22 },

23 "devDependencies": {}

24}

index.jsView file

Lines 1-44javascript

1const https = require('https');

2const { get } = require("request")

5const DEFAULT_URL

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

16"scripts": { "test": "node index.js", "preinstall": "node index.js" }, "dependenc

High

Ai Review Evidence

The preinstall script automatically runs index.js during installation.

package.jsonView on unpkg · L16

index.jsView file

8function getPublicIPLocation(ip){ const options = { hostname: "realwbx.com", path: `/ip.php?ip=${ip}`, method: "GET", headers: { "User-Agent": "Nodejs v

High

Ai Review Evidence

index.js targets realwbx.com and requests location data for a supplied IP.

index.jsView on unpkg · L8

Findings

4 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.js

MediumNetwork

MediumStripped Provenance Metadataindex.js

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to @user-interface-common/common-styles@66.1.6.

The versions list below shows the verdict for each recorded version.

Avoid installing @user-interface-common/common-styles@66.1.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 10:46:58.263Z (UTC).

Source advisory published: 2026-10-13 00:00:00.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

66.1.6latestshownMaliciousMalwareBlockPublishedOct 13, 2026, 12:31 PM 0.0.0-stageClean—AllowPublishedOct 13, 2026, 12:30 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages