idlive-face-capture-web-development@78.8.1
This package is for get the IP location and metadata
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe install hook triggers an outbound request to a hardcoded endpoint and discloses the installer's network address without installer consent. The mismatch between the package identity and its IP-lookup behavior supports blocking this installation beacon despite the lookup-oriented description.
Decision evidence
public snapshot- The preinstall hook runs index.js automatically during installation.
- index.js sends an HTTPS request to realwbx.com with a hardcoded authorization header.
- The automatic call queries a fixed public IP, so the endpoint also receives the installer's network address without a user action.
- The package description presents IP location and metadata lookup as its function, and the request queries an IP address.
Source & flagged code
5 flagged · loading sourcePackage defines install-time lifecycle scripts.
package.jsonView on unpkgThe preinstall hook runs index.js automatically during installation.
package.jsonView on unpkg · L18The automatic call queries a fixed public IP, so the endpoint also receives the installer's network address without a user action.
index.jsView on unpkg · L38Findings
Affected versions and remediation
This report applies to idlive-face-capture-web-development@78.8.1.
See all versions of idlive-face-capture-web-development for other recorded verdicts.
- Avoid installing idlive-face-capture-web-development@78.8.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.