registry / Malware / idlive-face-capture-web-development

idlive-face-capture-web-development

This package is for get the IP location and metadata

This report shows the evidence for idlive-face-capture-web-development@78.8.1, the only known version.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The install hook triggers an outbound request to a hardcoded endpoint and discloses the installer's network address without installer consent. The mismatch between the package identity and its IP-lookup behavior supports blocking this installation beacon despite the lookup-oriented description.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package through npm.

Impact

The endpoint receives an unsolicited installation-time request and can observe the installer's network address.

Mechanism

The preinstall hook runs index.js, which makes an HTTPS request to realwbx.com for a fixed IP and includes a hardcoded authorization header.

Attack narrative

During installation, the preinstall hook runs a fixed IP lookup against realwbx.com. The endpoint also receives the installer's network address. The lookup resembles the package description, but the package's face-capture identity does not explain why installation needs to contact this endpoint.

AI rationale

Evidence

package.jsonindex.js

Network endpoints1

realwbx.com/ip.php

Decision evidence

public snapshot

AI called this Malicious at 84.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook runs index.js automatically during installation.
index.js sends an HTTPS request to realwbx.com with a hardcoded authorization header.
The automatic call queries a fixed public IP, so the endpoint also receives the installer's network address without a user action.

Evidence against

The package description presents IP location and metadata lookup as its function, and the request queries an IP address.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.11 KB of source, external domains: realwbx.com

Source & flagged code

5 flagged

package.jsonView file

Lines 1-25json

2 "name": "idlive-face-capture-web-development",

3 "version": "78.8.1",

4 "description": "This package is for get the IP location and metadata",

5 "keywords": [

6 "ip"

7 ],

8 "license": "ISC",

9 "author": "conx3993",

10 "type": "commonjs",

11 "main": "index.js",

12 "files": [

13 "index.js",

14 "README.md"

15 ],

16 "scripts": {

17 "test": "node index.js",

18 "preinstall": "node index.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

19 },

20 "dependencies": {

21 "request": "^2.88.2"

22 },

High

Suspicious Lifecycle Evidence

The preinstall hook runs index.js automatically during installation.

package.jsonView on unpkg · L18

23 "devDependencies": {}

24}

index.jsView file

Lines 1-46javascript

1const https = require('https');

2const { get } = require("request")

5const DEFAULT_URL

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.preinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

18"preinstall": "node index.js" }, "dependencies": { "request": "^2.88.2" },

High

Suspicious Lifecycle Evidence

The preinstall hook runs index.js automatically during installation.

package.jsonView on unpkg · L18

index.jsView file

38getPublicIPLocation('8.8.8.8').then((data) => { console.log('Public IP Location:', data); }).catch((error) => { console.error('Error fetching public IP location:', error);

High

Ai Review Evidence

The automatic call queries a fixed public IP, so the endpoint also receives the installer's network address without a user action.

index.jsView on unpkg · L38

Findings

3 High3 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

MediumNetwork

MediumStripped Provenance Metadataindex.js

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to idlive-face-capture-web-development@78.8.1.

The versions list below shows the verdict for each recorded version.

Avoid installing idlive-face-capture-web-development@78.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 10:48:52.022Z (UTC).

Source advisory published: 2026-10-15 12:04:28.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

78.8.1latestshownMaliciousMalwareBlockPublishedOct 15, 2026, 12:04 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages