MAL-2026-17895

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web-pixels-manager/MAL-2026-17895.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17895
Aliases
  • GHSA-v6gx-6p2r-f6pp
Published
2026-10-15T13:01:07Z
Modified
2026-11-03T22:30:04Z
Summary
Malicious code in web-pixels-manager (npm)
Details

web-pixels-manager@76.2.4 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 207e4133bd083b9e3e89c5556fc8677e, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2a75cc1a77f4f7dce3f84c9b66aa2613ace8bccab0fffa5587a4a30ce9fdc71a)

Package name web-pixels-manager typosquats Shopify's scoped @shopify/web-pixels-manager; the stated description (get the IP location and metadata) is unrelated to that name and the README is a one-line stub. package.json declares preinstall: node index.js, and index.js executes top-level code on npm install that performs an HTTPS GET to https://realwbx.com/ip.php with a hardcoded Authorization bearer token (via getPublicIPLocation('8.8.8.8')). The destination is not a Shopify or publisher-matching host. The install-time outbound call allows the operator of realwbx.com to enumerate hosts that installed the package, timestamp them, and correlate them to the hardcoded token, providing a victim check-in channel under a typosquatted name.

Source: ghsa-malware (e356a18310639c31ebdb57fc6d325752ec05061c9e0db1892b1f013800d141c1)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "iocs": {
        "files": [
            {
                "digests": {
                    "sha256": "40708b047a1e820aff7a4d44de8f6853274049ca31a4e21f3d05a9f9abc4506c"
                },
                "note": "preinstall script: node index.js",
                "paths": [
                    "package.json"
                ],
                "source": "PACKAGE_ARCHIVE"
            },
            {
                "digests": {
                    "sha256": "8660426b963fecb43ff1911416a52a3679afc81781a279a1efa5001229116005"
                },
                "note": "Executed by the preinstall script of web-pixels-manager@76.2.4.",
                "paths": [
                    "index.js"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ],
        "urls": [
            "https://realwbx.com/ip.php"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021780",
            "import_time": "2026-10-26T06:39:42.497273142Z",
            "modified_time": "2026-10-26T06:31:56Z",
            "sha256": "2a75cc1a77f4f7dce3f84c9b66aa2613ace8bccab0fffa5587a4a30ce9fdc71a",
            "source": "amazon-inspector",
            "versions": [
                "76.2.4"
            ]
        },
        {
            "id": "GHSA-v6gx-6p2r-f6pp",
            "import_time": "2026-11-03T22:17:46.4902033Z",
            "modified_time": "2026-11-03T22:14:25Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "e356a18310639c31ebdb57fc6d325752ec05061c9e0db1892b1f013800d141c1",
            "source": "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / web-pixels-manager

Package

Name
web-pixels-manager
View open source insights on deps.dev
Purl
pkg:npm/web-pixels-manager

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

76.*
76.2.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "8660426b963fecb43ff1911416a52a3679afc81781a279a1efa5001229116005",
            "tlsh": "1221abaa5bf9112107f7ba498507d0076023e15f240eee257b5e93a11f9217d93a36f8"
        },
        {
            "path": "package.json",
            "sha256": "40708b047a1e820aff7a4d44de8f6853274049ca31a4e21f3d05a9f9abc4506c",
            "tlsh": "09f0a060ae219e3315e82ad15c7e654392a3ae6701587c193b97101c9fee15b00ff25e"
        }
    ],
    "package_integrity": [
        {
            "filename": "web-pixels-manager-76.2.4.tgz",
            "hashes": {
                "sha1": "4c4de6abf722e355100f57cf0f7297f565296e6a",
                "sha512_sri": "sha512-9loCZbro6BaUtGpv3cJ08i9luT/Ed1ZbKQHT0Et8WRa3x0tarpf2giHrmwAN4ahOxrlhNB2uQ72AoMhUoE8d5w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web-pixels-manager/MAL-2026-17895.json"