MAL-2026-17896

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xapi-lib/MAL-2026-17896.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17896
Published
2026-10-15T13:07:26Z
Modified
2026-10-16T07:30:04Z
Summary
Malicious code in xapi-lib (npm)
Details

xapi-lib@88.2.3, 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which is the same in all four versions and differs from the value in each of the account's other packages. The npm account conx3993 published xapi-lib on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (beac62be73c115f383ea095cc364879294d6c105817d3c0eb6bfb30ce7bcf46c)

xapi-lib@88.2.3 declares preinstall: node index.js in package.json, and index.js performs an unconditional top-level HTTPS GET to realwbx.com/ip.php (passing 8.8.8.8 and a hardcoded Authorization header) on load. The call fires automatically during npm install, sending the installer's source IP to a hardcoded non-publisher endpoint unrelated to any advertised functionality. The package itself is a one-file stub with no library content, so dependency resolution plus the preinstall beacon is the entire effect of installing it. The destination realwbx.com is not a publisher-aligned domain, the request is not caller-configurable, and no documentation discloses the outbound call.

Database specific 
{
    "iocs":  {
        "files":  [
            {
                "digests":  {
                    "sha256":  "6b2fcfa860c46ed88f188cc1fab187d43b8a0278691b1711822925f8245c8d19"
                },
                "note":  "preinstall script: node index.js",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "99a601e9bf8688f9f8650528f1da84b349de36f98444bcec2cf4a9012ea2339d"
                },
                "note":  "Executed by the preinstall script of xapi-lib@88.2.5.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "f844ce26df73b3a8958ea7a1d06032a0092f714c3a50108b130989a986270682"
                },
                "note":  "preinstall script: node index.js",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "defcc41c3e9e5d7047e9d57db37086833e9b65319a98fb324f69e87817c103f7"
                },
                "note":  "Executed by the preinstall script of xapi-lib@88.2.3.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "3a74e42c644363219b7e056a212aa44f80417e6112ec0c0172fb53aabefd2ce4"
                },
                "note":  "preinstall script: node index.js",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "e571cff8c883aa4aed6b6319ff72bfc8401575126118df716b848052631383fe"
                },
                "note":  "Executed by the preinstall script of xapi-lib@90.2.1.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "f736035d37903edb04ff8f987ceb364e39d5a5de2897ba3e56e777b4e1eae332"
                },
                "note":  "preinstall script: node index.js",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "58a9969194fd80f080da6082fab45e77fa348b3046ae923a4cb500e0df3b96b2"
                },
                "note":  "Executed by the preinstall script of xapi-lib@90.3.1.",
                "paths":  [
                    "index.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://realwbx.com/ip.php"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021504",
            "import_time":  "2026-10-16T07:22:52.427697019Z",
            "modified_time":  "2026-10-16T06:58:06Z",
            "sha256":  "08fefb7bcc7ef9e212432c91ec73a326965240fdbcb7782e3d2fb61155fe6d45",
            "source":  "amazon-inspector",
            "versions":  [
                "88.2.5"
            ]
        },
        {
            "id":  "IN-MAL-2026-021505",
            "import_time":  "2026-10-16T07:22:52.475260459Z",
            "modified_time":  "2026-10-16T06:58:14Z",
            "sha256":  "beac62be73c115f383ea095cc364879294d6c105817d3c0eb6bfb30ce7bcf46c",
            "source":  "amazon-inspector",
            "versions":  [
                "88.2.3"
            ]
        },
        {
            "id":  "IN-MAL-2026-021502",
            "import_time":  "2026-10-16T07:22:52.34017146Z",
            "modified_time":  "2026-10-16T06:57:48Z",
            "sha256":  "c2cad7956f6504f2fefff4ce1a2a3309660ebcc8dd6858f41085f478ad5909ef",
            "source":  "amazon-inspector",
            "versions":  [
                "90.3.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021503",
            "import_time":  "2026-10-16T07:22:52.395931618Z",
            "modified_time":  "2026-10-16T06:57:59Z",
            "sha256":  "e82133a7b4558aea71dd4629832347ac615573b581ee941960ab4b0244781779",
            "source":  "amazon-inspector",
            "versions":  [
                "90.2.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / xapi-lib

Package

Name
xapi-lib
View open source insights on deps.dev
Purl
pkg:npm/xapi-lib

Affected ranges

Affected versions

88.*
88.2.3
88.2.5
90.*
90.2.1
90.3.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "99a601e9bf8688f9f8650528f1da84b349de36f98444bcec2cf4a9012ea2339d",
            "tlsh":  "7821ebaa5bf9112107f3fa8d860790072023e05f240eee157a0d53a11f8223d93936f8"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "xapi-lib-88.2.5.tgz",
            "hashes":  {
                "sha1":  "32ed607955bc6ec72e8bfcf2b27da5fcca103b09",
                "sha512_sri":  "sha512-Bf3uldyd5rjG5xrNBaz57wyjchQq9o0RUhkXN0IPIzW3AlG5/GQDMAoAWnDTubX7M6TO8Uyj9h0eG1+M0zsVEQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/xapi-lib/MAL-2026-17896.json"