{"id":"MAL-2026-17895","revision":"53a33253c8df4de5a7a3142cdfd75b46","records":[{"revision":"53a33253c8df4de5a7a3142cdfd75b46","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17895","aliases":[],"title":"Malicious code in web-pixels-manager (npm)","description":"web-pixels-manager@76.2.4 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `207e4133bd083b9e3e89c5556fc8677e`, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.","state":0,"publishedAt":"2026-10-15T13:01:07+00:00","modifiedAt":"2026-10-16T04:15:19.5773911+00:00","affected":[{"ecosystem":"npm","name":"web-pixels-manager","ranges":[],"versions":["76.2.4"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/web-pixels-manager"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17895","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17895","identifiers":["MAL-2026-17895"]},"retained":false,"historicalAffected":[]}],"coverage":[]}