1859 matches found
Malicious code in xapi-lib (npm)
[email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which i...
Malicious code in buyerdashboard (npm)
[email protected] describes itself as "User dashboard IP info". Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 8eb5e8641a5795b022d68e14d8858415, which differs from the value in each of the account...
Malicious code in web-pixels-manager (npm)
[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 207e4133bd083b9e3e89c5556fc8677e, which differs from the...
Malicious code in idlive-face-capture-web-development (npm)
[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value a3b620ea8719eae2fa9b62726364bcc9, which...
MAL-2026-17893 Malicious code in buyerdashboard (npm)
[email protected] describes itself as "User dashboard IP info". Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 8eb5e8641a5795b022d68e14d8858415, which differs from the value in each of the account...
Malicious code in xapi-lib (npm)
[email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which i...
MAL-2026-17896 Malicious code in xapi-lib (npm)
[email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which i...
MAL-2026-17895 Malicious code in web-pixels-manager (npm)
[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 207e4133bd083b9e3e89c5556fc8677e, which differs from the...
MAL-2026-17894 Malicious code in idlive-face-capture-web-development (npm)
[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value a3b620ea8719eae2fa9b62726364bcc9, which...
Malicious code in idlive-face-capture-web-development (npm)
[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value a3b620ea8719eae2fa9b62726364bcc9, which...
Malicious code in @user-interface-common/common-styles (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
Malicious code in @mntv-analysis/ui (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 99.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
Malicious code in @mntv-analysis/workspaces-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 65.11.3 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', whic...
Malicious code in @mntv-analysis/ui-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 50.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs node index.js || true on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to...
Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs node index.js || true on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to...
MAL-2026-17867 Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs node index.js || true on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to...
MAL-2026-17869 Malicious code in @mntv-analysis/ui (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 99.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
MAL-2026-17870 Malicious code in @mntv-analysis/ui-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 50.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
MAL-2026-17871 Malicious code in @mntv-analysis/workspaces-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 65.11.3 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', whic...