registry / Malware / xapi-lib / 90.2.1

xapi-lib@90.2.1

This package is for get the IP location and metadata

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The manifest automatically runs the entrypoint during preinstall, and the entrypoint sends a fixed example lookup to a hardcoded endpoint. This is an unsolicited installation-time beacon, so the source supports blocking it as install-hook abuse.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package runs its preinstall hook.

Impact

The endpoint receives an unsolicited request from the install environment and can observe its public network address.

Mechanism

The hook runs index.js, which sends an HTTPS request with a fixed authorization tag to look up 8.8.8.8.

Attack narrative

During package installation, the preinstall hook runs an example lookup for 8.8.8.8. The entrypoint sends the request to realwbx.com with a fixed authorization tag, exposing the install environment's public network address. The package describes IP lookup functionality, but that lookup has no apparent installation need or installer consent boundary.

AI rationale

Evidence

package.jsonindex.js

Network endpoints1

realwbx.com/ip.php

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The package preinstall hook runs index.js automatically during installation.
The entrypoint sends an HTTPS GET to realwbx.com and includes a fixed authorization tag.
The request is ended and sent by the entrypoint.
The entrypoint automatically looks up the fixed address 8.8.8.8 without requiring a caller action.

Evidence against

The package describes IP location and metadata functionality, which aligns with the lookup itself but does not explain why it runs during installation.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.11 KB of source, external domains: realwbx.com

Source & flagged code

8 flagged

index.jsView file

Lines 1-46javascript

1const https = require('https');

2const { get } = require("request")

5const DEFAULT_URL = 'https://realwbx.com/ip.php';

8function getPublicIPLocation(ip){

9 const options = {

10 hostname: "realwbx.com",

11 path: `/ip.php?ip=${ip}`,

12 method: "GET",

13 headers: {

Medium

Stripped Provenance Metadata

The entrypoint sends an HTTPS GET to realwbx.com and includes a fixed authorization tag.

index.jsView on unpkg · L5

14 "User-Agent": "Nodejs v4.1.0",

15 "Authorization": "fa79878bc2cfb48bd5127ae26fb661b1"

16 }

17 }

18 return new Promise((resolve, reject) => {

19 const req = https.request(options, (res) => {

Medium

Stripped Provenance Metadata

The entrypoint sends an HTTPS GET to realwbx.com and includes a fixed authorization tag.

index.jsView on unpkg · L13

20 let data = '';

21 res.on('data', (chunk) => {

22 data += chunk;

23 });

24 res.on('end', () => {

25 resolve(data);

26 });

27 });

28 req.on('error', (e) => {

29 reject(e);

30 });

31 req.end();

32 });

33}

36// Example usage remove this in production

High

Ai Review Evidence

The request is ended and sent by the entrypoint.

index.jsView on unpkg · L28

37console.log('Fetching public IP location...');

38getPublicIPLocation('8.8.8.8').then((data) => {

39 console.log('Public IP Location:', data);

40}).catch((error) => {

41 console.error('Error fetching public IP location:', error);

High

Ai Review Evidence

The entrypoint automatically looks up the fixed address 8.8.8.8 without requiring a caller action.

index.jsView on unpkg · L36

42});

44exports.getPublicIPLocation = getPublicIPLocation;

•Published source reference

High

Network

Independent review focus: trace hardcoded Authorization tag, req.end, automatic example call, effective consent and actual need to run that example during installation.

index.jsView on unpkg

package.jsonView file

Lines 1-25json

2 "name": "xapi-lib",

3 "version": "90.2.1",

4 "description": "This package is for get the IP location and metadata",

5 "keywords": [

6 "ip"

Source & flagged code

8 flagged · loading source

index.jsView file

•Published source reference

High

Network

Independent review focus: trace hardcoded Authorization tag, req.end, automatic example call, effective consent and actual need to run that example during installation.

index.jsView on unpkg

28req.on('error', (e) => { reject(e); }); req.end(); }); } /

High

Ai Review Evidence

The request is ended and sent by the entrypoint.

index.jsView on unpkg · L28

36// Example usage remove this in production console.log('Fetching public IP location...'); getPublicIPLocation('8.8.8.8').then((data) => { console.log('Public IP Location:', data); }).catch((error) => { console.error('Error fetc

High

Ai Review Evidence

The entrypoint automatically looks up the fixed address 8.8.8.8 without requiring a caller action.

index.jsView on unpkg · L36

5const DEFAULT_URL = 'https://realwbx.com/ip.php'; function getPublicIPLocation(ip){ const options = { hostname: "realwbx.com", path: `/ip.php?ip=${ip}`, method: "GET",

Findings

6 High3 Medium2 Low

HighNetworkindex.js

HighNetworkpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

MediumNetwork

MediumStripped Provenance Metadataindex.js

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to xapi-lib@90.2.1.

See all versions of xapi-lib for other recorded verdicts.

Avoid installing xapi-lib@90.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 11:21:19.056Z (UTC).

Source advisory published: 2026-10-15 13:07:26.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages