{"id":"MAL-2026-17894","summary":"Malicious code in idlive-face-capture-web-development (npm)","details":"idlive-face-capture-web-development@78.8.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `a3b620ea8719eae2fa9b62726364bcc9`, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (865b0bca2fc5b7c16a7a6cc7b7b1669148b2c5f766cae9a3f43dd78f7427277a)\nPackage declares scripts.preinstall=\"node index.js\", which on npm install unconditionally issues an HTTPS GET to https://realwbx.com/ip.php with a hardcoded Authorization token, revealing the installer's public IP, User-Agent, and install timing to a third-party host unrelated to the package's declared publisher. Package identity is inconsistent in ways typical of a dependency-confusion/typosquat probe: the package name is idlive-face-capture-web-development, the README body is fiji-core-foundation, the description says \"for get the IP location and metadata\", and the author (conx3993) and keywords do not correspond to any legitimate face-capture SDK. Installing this package produces an attacker-controlled callback confirming successful execution on the victim host.\n","modified":"2026-10-16T07:30:04.760454801Z","published":"2026-10-15T12:04:28Z","database_specific":{"iocs":{"urls":["https://realwbx.com/ip.php"],"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"ef302d0f539b6c32f536429c5d0589118bb0d703220eda38dd56081e18ad94eb"},"note":"preinstall script: node index.js","paths":["package.json"]},{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"7a777aee33fd6f4c88cc2da90cbbe6f817e43ab2c2a6c7ff41753782a32d8cf4"},"note":"Executed by the preinstall script of idlive-face-capture-web-development@78.8.1.","paths":["index.js"]}]},"malicious-packages-origins":[{"sha256":"865b0bca2fc5b7c16a7a6cc7b7b1669148b2c5f766cae9a3f43dd78f7427277a","source":"amazon-inspector","versions":["78.8.1"],"id":"IN-MAL-2026-021506","import_time":"2026-10-16T07:22:52.52447891Z","modified_time":"2026-10-16T06:58:22Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/idlive-face-capture-web-development"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/idlive-face-capture-web-development/v/78.8.1"}],"affected":[{"package":{"name":"idlive-face-capture-web-development","ecosystem":"npm","purl":"pkg:npm/idlive-face-capture-web-development"},"versions":["78.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"7a777aee33fd6f4c88cc2da90cbbe6f817e43ab2c2a6c7ff41753782a32d8cf4","tlsh":"842189aa5bf511210bf7ba49850790076013e15f240eee557e1d53a51f8213d93a26f9","path":"index.js"},{"path":"package.json","sha256":"ef302d0f539b6c32f536429c5d0589118bb0d703220eda38dd56081e18ad94eb","tlsh":"21f02074ad208e3351e43ad24cbe648392a3ae6701183c193bd7001c9fee56b41ff26d"}],"package_integrity":[{"hashes":{"sha1":"c235a8bcf4ef7962f90b7584b4bb6a25b7a93000","sha512_sri":"sha512-skMbWKoZVkU6xPkb4YXaO7/3to9zNCfHoAGKdvGDFlYlDDOWO/1YGLkacSip/smXC/sKL6bFVcCUfayYl6vYZA=="},"filename":"idlive-face-capture-web-development-78.8.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/idlive-face-capture-web-development/MAL-2026-17894.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}