registry / Malware / xapi-lib / 90.3.1

xapi-lib@90.3.1

This package is for get the IP location and metadata

AI Security Review

scanned 7d ago · by lpm-firewall-ai

The package automatically sends an install-time request to a publisher-selected endpoint, with a hardcoded tag and no consent check. The lookup feature matches the package description, but the installation-triggered example is unnecessary and discloses the installer's network address.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing the package, which runs the preinstall hook.

Impact

The endpoint can observe the installer's network address and associate the request with the hardcoded tag.

Mechanism

The hook runs index.js, which makes an HTTPS request to realwbx.com for a fixed IP lookup.

Attack narrative

The preinstall hook runs an example lookup that is unrelated to installation. It contacts a fixed external endpoint with a hardcoded authorization tag, exposing the installer's network address without a consent gate.

AI rationale

Evidence

package.jsonindex.js

Network endpoints2

realwbx.comrealwbx.com/ip.php

Decision evidence

public snapshot

AI called this Malicious at 88.0% confidence as Malware with low false-positive risk.

Evidence for block

The preinstall hook runs index.js automatically during installation.
The entrypoint sends an HTTPS lookup request to realwbx.com with a hardcoded authorization tag.
The entrypoint invokes the lookup unconditionally for a fixed public IP, without a consent check.

Evidence against

IP location lookup matches the package's stated purpose, but running its example during installation is not needed for that feature.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 1.11 KB of source, external domains: realwbx.com

Source & flagged code

7 flagged

index.jsView file

Lines 1-46javascript

1const https = require('https');

2const { get } = require("request")

5const DEFAULT_URL = 'https://realwbx.com/ip.php';

8function getPublicIPLocation(ip){

9 const options = {

10 hostname: "realwbx.com",

11 path: `/ip.php?ip=${ip}`,

12 method: "GET",

13 headers: {

14 "User-Agent": "Nodejs v4.1.00",

Medium

Stripped Provenance Metadata

The entrypoint sends an HTTPS lookup request to realwbx.com with a hardcoded authorization tag.

index.jsView on unpkg · L5

15 "Authorization": "fa79878bc2cfb48bd5127ae26fb661b1"

16 }

17 }

18 return new Promise((resolve, reject) => {

19 const req = https.request(options, (res) => {

20 let data = '';

21 res.on('data', (chunk) => {

22 data += chunk;

23 });

24 res.on('end', () => {

25 resolve(data);

Medium

Stripped Provenance Metadata

The entrypoint sends an HTTPS lookup request to realwbx.com with a hardcoded authorization tag.

index.jsView on unpkg · L15

26 });

27 });

28 req.on('error', (e) => {

29 reject(e);

30 });

31 req.end();

32 });

33}

36// Example usage remove this in production

37console.log('Fetching public IP location...');

38getPublicIPLocation('8.8.8.8').then((data) => {

39 console.log('Public IP Location:', data);

40}).catch((error) => {

41 console.error('Error fetching public IP location:', error);

42});

44exports.getPublicIPLocation = getPublicIPLocation;

High

Ai Review Evidence

The entrypoint invokes the lookup unconditionally for a fixed public IP, without a consent check.

index.jsView on unpkg · L38

•Published source reference

High

Network

Independent review focus: trace hardcoded Authorization tag, req.end, automatic example call, effective consent and actual need to run that example during installation.

index.jsView on unpkg

package.jsonView file

Lines 1-25json

2 "name": "xapi-lib",

3 "version": "90.3.1",

4 "description": "This package is for get the IP location and metadata",

5 "keywords": [

6 "ip"

Source & flagged code

7 flagged · loading source

index.jsView file

•Published source reference

High

Network

Independent review focus: trace hardcoded Authorization tag, req.end, automatic example call, effective consent and actual need to run that example during installation.

index.jsView on unpkg

38getPublicIPLocation('8.8.8.8').then((data) => { console.log('Public IP Location:', data); }).catch((error) => { console.error('Error fetching public IP location:', error); }); exports.getPublicIPLocation = getPublicIPLocation;

High

Ai Review Evidence

The entrypoint invokes the lookup unconditionally for a fixed public IP, without a consent check.

index.jsView on unpkg · L38

5const DEFAULT_URL = 'https://realwbx.com/ip.php'; function getPublicIPLocation(ip){ const options = { hostname: "realwbx.com", path: `/ip.php?ip=${ip}`, method: "GET", headers: { "

Medium

Stripped Provenance Metadata

The entrypoint sends an HTTPS lookup request to realwbx.com with a hardcoded authorization tag.

index.jsView on unpkg · L5

Findings

5 High3 Medium2 Low

HighNetworkindex.js

HighNetworkpackage.json

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

MediumNetwork

MediumStripped Provenance Metadataindex.js

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to xapi-lib@90.3.1.

See all versions of xapi-lib for other recorded verdicts.

Avoid installing xapi-lib@90.3.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-16 11:19:22.423Z (UTC).

Source advisory published: 2026-10-15 13:07:26.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages