Vulnerability MAL-2026-17896

[email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which is the same in all four versions and differs from the value in each of the account's other packages. The npm account conx3993 published xapi-lib on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.