{"id":"MAL-2026-17893","summary":"Malicious code in buyerdashboard (npm)","details":"buyerdashboard@45.3.4 describes itself as \"User dashboard IP info\". Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `8eb5e8641a5795b022d68e14d8858415`, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.","modified":"2026-10-16T04:15:23.583720660Z","published":"2026-10-15T13:28:14Z","database_specific":{"iocs":{"files":[{"digests":{"sha256":"da97824f68417bbbcfcfb53747c8c467afe7e1995b87b7011a3a33e9b845b253"},"note":"preinstall script: node index.js","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"95eac19024b26c749f3866a710c9ecbce2796c54345a9c4985902452195aa1b9"},"note":"Executed by the preinstall script of buyerdashboard@45.3.4.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://realwbx.com/ip.php"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/buyerdashboard"}],"affected":[{"package":{"name":"buyerdashboard","ecosystem":"npm","purl":"pkg:npm/buyerdashboard"},"versions":["45.3.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/buyerdashboard/MAL-2026-17893.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.0","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}