monkey-tags-ip
Get your IP address
This report shows the evidence for monkey-tags-ip@53.4.1. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.0-stage, is allowed. See all versions.
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe preinstall hook automatically contacts an external IP lookup endpoint, exposing the installer's public IP without a user request. Although IP lookup matches the package description, running it during installation and discarding the result makes this an unconsented install-time disclosure.
Decision evidence
public snapshot- The preinstall lifecycle script runs `node ip.js` automatically.
- `ip.js` makes a GET request to `realwbx.com/ip?f=json` with a hard-coded bearer token; the request exposes the installer's public IP to that host.
- `ip.js` calls `getIPAddress()` at top level and discards the result, so the request occurs during preinstall without a user request.
- The package description says “Get your IP address,” and the request path is an IP lookup endpoint.
Source & flagged code
5 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgPackage declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkgThe preinstall lifecycle script runs `node ip.js` automatically.
package.jsonView on unpkg · L8Findings
Affected versions and remediation
This report applies to monkey-tags-ip@53.4.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing monkey-tags-ip@53.4.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.