buyerdashboard@45.3.4
User dashboard IP info
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe preinstall hook performs an automatic network disclosure to a publisher-selected service, with no source-level consent gate. The fixed lookup value and package description explain the API's function but do not establish consent to disclose the installer's network address during installation.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Package installation runs the preinstall script, which executes index.js.
Impact
The service receives the installer's public network address during installation.
Mechanism
index.js makes an HTTPS GET request for a fixed IP lookup and includes a hardcoded Authorization header.
Attack narrative
During installation, the preinstall hook executes index.js, which sends an HTTPS request to realwbx.com with a hardcoded Authorization header. Although the lookup uses a fixed public IP and aligns with the package's stated IP-information function, the install-time request also discloses the installer's public network address without a separate action or consent boundary.
AI rationale
The preinstall hook performs an automatic network disclosure to a publisher-selected service, with no source-level consent gate. The fixed lookup value and package description explain the API's function but do not establish consent to disclose the installer's network address during installation.
Evidence
package.jsonindex.js
Network endpoints1
realwbx.com
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- The preinstall hook automatically runs index.js during installation.
- index.js sends an HTTPS GET request to realwbx.com with a hardcoded Authorization header.
- The install-triggered request looks up the fixed address 8.8.8.8, while the request also exposes the installer's public network address to the service.
Evidence against
- The package describes itself as providing IP information, and the endpoint performs an IP lookup.
Behavioral surface
Network
UrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Runtime dependency names matching Node built-ins: https
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkg11"preinstall": "node index.js"
},
"dependencies": {
"https": "^1.0.0",
"request": "^2.88.2"
}
High
Suspicious Lifecycle Evidence
The preinstall hook automatically runs index.js during installation.
package.jsonView on unpkg · L11index.jsView file
Findings
5 High2 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighNode Builtin Dependency Squatpackage.json
HighKnown Malware Source Fingerprint Signatureindex.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
MediumNetwork
MediumStripped Provenance Metadataindex.js
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to buyerdashboard@45.3.4.
See all versions of buyerdashboard for other recorded verdicts.
- Avoid installing buyerdashboard@45.3.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.