monkey-tags-ip@53.4.1
Get your IP address
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe preinstall hook automatically contacts an external IP lookup endpoint, exposing the installer's public IP without a user request. Although IP lookup matches the package description, running it during installation and discarding the result makes this an unconsented install-time disclosure.
Static reason
One or more suspicious static signals were detected.
Trigger
Package installation runs the preinstall script.
Impact
The remote endpoint learns the installer's public IP without an explicit request to perform the lookup.
Mechanism
The script invokes an IP lookup that sends a GET request with a fixed bearer token; its response is discarded.
Attack narrative
During installation, the preinstall hook runs ip.js. Its top-level call sends a GET request to realwbx.com for an IP lookup, disclosing the installer's public IP to the endpoint without an explicit user request. The response is discarded, and the request includes a hard-coded bearer token.
AI rationale
The preinstall hook automatically contacts an external IP lookup endpoint, exposing the installer's public IP without a user request. Although IP lookup matches the package description, running it during installation and discarding the result makes this an unconsented install-time disclosure.
Evidence
package.jsonip.js
Network endpoints1
realwbx.com
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- The preinstall lifecycle script runs `node ip.js` automatically.
- `ip.js` makes a GET request to `realwbx.com/ip?f=json` with a hard-coded bearer token; the request exposes the installer's public IP to that host.
- `ip.js` calls `getIPAddress()` at top level and discards the result, so the request occurs during preinstall without a user request.
Evidence against
- The package description says “Get your IP address,” and the request path is an IP lookup endpoint.
Behavioral surface
Network
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.preinstall = node ip.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•Runtime dependency names matching Node built-ins: https
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkg8"main": "index.js",
"scripts": {
"preinstall": "node ip.js"
},
"dependencies": {
"https": "^1.0.0",
High
Suspicious Lifecycle Evidence
The preinstall lifecycle script runs `node ip.js` automatically.
package.jsonView on unpkg · L8ip.jsView file
Findings
5 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
HighNode Builtin Dependency Squatpackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceip.js
HighAi Review Evidenceip.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to monkey-tags-ip@53.4.1.
See all versions of monkey-tags-ip for other recorded verdicts.
- Avoid installing monkey-tags-ip@53.4.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.