registry / Malware / xapi-lib / 88.2.5

xapi-lib@88.2.5

This package is for get the IP location and metadata

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The preinstall hook triggers an unnecessary network request that identifies the package request and exposes installer network metadata. This supports blocking as install-hook abuse; the inspected source does not show credential or local-file theft.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs its preinstall hook, which executes index.js and invokes the example lookup.

Impact

The service can observe installation activity and the installer’s network address; source inspection does not show local file collection or credential theft.

Mechanism

The example requests the location of a fixed public IP from realwbx.com, sends a hardcoded Authorization tag, and completes the HTTPS request without a consent check.

Attack narrative

The preinstall hook executes an example lookup automatically. That call sends a hardcoded Authorization tag to realwbx.com and exposes the installer’s network address. The lookup API matches the package’s stated function, but querying a fixed IP during installation serves no demonstrated setup need and has no consent gate.

AI rationale

Evidence

package.jsonindex.js

Network endpoints1

realwbx.com/ip.php

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook executes index.js, activating it during installation.
The request sends a fixed-IP lookup to realwbx.com with a hardcoded Authorization tag and ends the HTTPS request.
The example lookup runs at module load without a user action or consent check.

Evidence against

The request performs an IP-location lookup, which matches the package’s stated purpose; however, that does not explain running the example during installation.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.11 KB of source, external domains: realwbx.com

Source & flagged code

9 flagged

.lpm-investigation-context/evidence.jsonView file

•Published source reference

High

Network

Independent evidence contains separately hash/SRI-verified related snapshots, not target-shipped files. Inspect their source to assess callback purpose and activation; no verdict is implied.

.lpm-investigation-context/evidence.jsonView on unpkg

index.jsView file

Lines 1-46javascript

1const https = require('https');

2const { get } = require("request")

5const DEFAULT_URL = 'https://realwbx.com/ip.php';

8function getPublicIPLocation(ip){

9 const options = {

10 hostname: "realwbx.com",

11 path: `/ip.php?ip=${ip}`,

12 method: "GET",

13 headers: {

14 "User-Agent": "Nodejs v3.17.0",

15 "Authorization": "fa79878bc2cfb48bd5127ae26fb661b1"

Medium

Stripped Provenance Metadata

The request sends a fixed-IP lookup to realwbx.com with a hardcoded Authorization tag and ends the HTTPS request.

index.jsView on unpkg · L8

16 }

17 }

18 return new Promise((resolve, reject) => {

Medium

Stripped Provenance Metadata

The request sends a fixed-IP lookup to realwbx.com with a hardcoded Authorization tag and ends the HTTPS request.

index.jsView on unpkg · L13

19 const req = https.request(options, (res) => {

20 let data = '';

21 res.on('data', (chunk) => {

22 data += chunk;

23 });

24 res.on('end', () => {

25 resolve(data);

26 });

27 });

28 req.on('error', (e) => {

29 reject(e);

30 });

31 req.end();

32 });

33}

36// Example usage remove this in production

Medium

Stripped Provenance Metadata

The request sends a fixed-IP lookup to realwbx.com with a hardcoded Authorization tag and ends the HTTPS request.

index.jsView on unpkg · L28

37console.log('Fetching public IP location...');

38getPublicIPLocation('8.8.8.8').then((data) => {

39 console.log('Public IP Location:', data);

40}).catch((error) => {

41 console.error('Error fetching public IP location:', error);

42});

44exports.getPublicIPLocation = getPublicIPLocation;

•Published source reference

High

Network

Independent review focus: trace hardcoded Authorization tag, req.end, automatic example call, effective consent and actual need to run that example during installation.

index.jsView on unpkg

package.jsonView file

Lines 1-25json

2 "name": "xapi-lib",

3 "version": "88.2.5",

4 "description": "This package is for get the IP location and metadata",

5 "keywords": [

6 "ip"

.lpm-investigation-context/snapshot-0/index.jsView file

•Published source reference

High

Network

Compare the lookup implementation in the verified dashboard package with this target. Distinct fixed request tags and an automatic example are observable source facts.

.lpm-investigation-context/snapshot-0/index.jsView on unpkg

Source & flagged code

9 flagged · loading source

.lpm-investigation-context/evidence.jsonView file

•Published source reference

High

Network

Independent evidence contains separately hash/SRI-verified related snapshots, not target-shipped files. Inspect their source to assess callback purpose and activation; no verdict is implied.

.lpm-investigation-context/evidence.jsonView on unpkg

index.jsView file

•Published source reference

High

Network

Independent review focus: trace hardcoded Authorization tag, req.end, automatic example call, effective consent and actual need to run that example during installation.

index.jsView on unpkg

8function getPublicIPLocation(ip){ const options = { hostname: "realwbx.com", path: `/ip.php?ip=${ip}`, method: "GET", headers: { "User-Agent": "Nodejs v3.17.0", "Aut

Medium

Stripped Provenance Metadata

The request sends a fixed-IP lookup to realwbx.com with a hardcoded Authorization tag and ends the HTTPS request.

Findings

6 High4 Medium2 Low

HighNetwork.lpm-investigation-context/evidence.json

HighNetworkindex.js

HighNetworkpackage.json

HighNetwork.lpm-investigation-context/snapshot-0/index.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumNetwork

MediumStripped Provenance Metadataindex.js

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to xapi-lib@88.2.5.

See all versions of xapi-lib for other recorded verdicts.

Avoid installing xapi-lib@88.2.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 11:25:18.929Z (UTC).

Source advisory published: 2026-10-15 13:07:26.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages