MAL-2026-17894

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/idlive-face-capture-web-development/MAL-2026-17894.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17894
Published
2026-10-15T12:04:28Z
Modified
2026-10-16T07:30:04Z
Summary
Malicious code in idlive-face-capture-web-development (npm)
Details

idlive-face-capture-web-development@78.8.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value a3b620ea8719eae2fa9b62726364bcc9, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (865b0bca2fc5b7c16a7a6cc7b7b1669148b2c5f766cae9a3f43dd78f7427277a)

Package declares scripts.preinstall="node index.js", which on npm install unconditionally issues an HTTPS GET to https://realwbx.com/ip.php with a hardcoded Authorization token, revealing the installer's public IP, User-Agent, and install timing to a third-party host unrelated to the package's declared publisher. Package identity is inconsistent in ways typical of a dependency-confusion/typosquat probe: the package name is idlive-face-capture-web-development, the README body is fiji-core-foundation, the description says "for get the IP location and metadata", and the author (conx3993) and keywords do not correspond to any legitimate face-capture SDK. Installing this package produces an attacker-controlled callback confirming successful execution on the victim host.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "ef302d0f539b6c32f536429c5d0589118bb0d703220eda38dd56081e18ad94eb"
                },
                "note":  "preinstall script: node index.js",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "7a777aee33fd6f4c88cc2da90cbbe6f817e43ab2c2a6c7ff41753782a32d8cf4"
                },
                "note":  "Executed by the preinstall script of idlive-face-capture-web-development@78.8.1.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://realwbx.com/ip.php"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021506",
            "import_time":  "2026-10-16T07:22:52.52447891Z",
            "modified_time":  "2026-10-16T06:58:22Z",
            "sha256":  "865b0bca2fc5b7c16a7a6cc7b7b1669148b2c5f766cae9a3f43dd78f7427277a",
            "source":  "amazon-inspector",
            "versions":  [
                "78.8.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / idlive-face-capture-web-development

Package

Name
idlive-face-capture-web-development
View open source insights on deps.dev
Purl
pkg:npm/idlive-face-capture-web-development

Affected ranges

Affected versions

78.*
78.8.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "7a777aee33fd6f4c88cc2da90cbbe6f817e43ab2c2a6c7ff41753782a32d8cf4",
            "tlsh":  "842189aa5bf511210bf7ba49850790076013e15f240eee557e1d53a51f8213d93a26f9"
        },
        {
            "path":  "package.json",
            "sha256":  "ef302d0f539b6c32f536429c5d0589118bb0d703220eda38dd56081e18ad94eb",
            "tlsh":  "21f02074ad208e3351e43ad24cbe648392a3ae6701183c193bd7001c9fee56b41ff26d"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "idlive-face-capture-web-development-78.8.1.tgz",
            "hashes":  {
                "sha1":  "c235a8bcf4ef7962f90b7584b4bb6a25b7a93000",
                "sha512_sri":  "sha512-skMbWKoZVkU6xPkb4YXaO7/3to9zNCfHoAGKdvGDFlYlDDOWO/1YGLkacSip/smXC/sKL6bFVcCUfayYl6vYZA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/idlive-face-capture-web-development/MAL-2026-17894.json"