web-pixels-manager

{"schema_version":"1.7.4","id":"MAL-2026-17895","published":"2026-10-15T13:01:07Z","modified":"2026-11-03T22:19:51.005640584Z","aliases":["GHSA-v6gx-6p2r-f6pp"],"summary":"Malicious code in web-pixels-manager (npm)","details":"web-pixels-manager@76.2.4 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `207e4133bd083b9e3e89c5556fc8677e`, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a75cc1a77f4f7dce3f84c9b66aa2613ace8bccab0fffa5587a4a30ce9fdc71a)\nPackage name `web-pixels-manager` typosquats Shopify's scoped `@shopify/web-pixels-manager`; the stated description (`get the IP location and metadata`) is unrelated to that name and the README is a one-line stub. `package.json` declares `preinstall: node index.js`, and `index.js` executes top-level code on `npm install` that performs an HTTPS GET to `https://realwbx.com/ip.php` with a hardcoded `Authorization` bearer token (via `getPublicIPLocation('8.8.8.8')`). The destination is not a Shopify or publisher-matching host. The install-time outbound call allows the operator of realwbx.com to enumerate hosts that installed the package, timestamp them, and correlate them to the hardcoded token, providing a victim check-in channel under a typosquatted name.\n\n## Source: ghsa-malware (e356a18310639c31ebdb57fc6d325752ec05061c9e0db1892b1f013800d141c1)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"web-pixels-manager","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["76.2.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"8660426b963fecb43ff1911416a52a3679afc81781a279a1efa5001229116005","tlsh":"1221abaa5bf9112107f7ba498507d0076023e15f240eee257b5e93a11f9217d93a36f8"},{"path":"package.json","sha256":"40708b047a1e820aff7a4d44de8f6853274049ca31a4e21f3d05a9f9abc4506c","tlsh":"09f0a060ae219e3315e82ad15c7e654392a3ae6701587c193b97101c9fee15b00ff25e"}],"package_integrity":[{"filename":"web-pixels-manager-76.2.4.tgz","hashes":{"sha1":"4c4de6abf722e355100f57cf0f7297f565296e6a","sha512_sri":"sha512-9loCZbro6BaUtGpv3cJ08i9luT/Ed1ZbKQHT0Et8WRa3x0tarpf2giHrmwAN4ahOxrlhNB2uQ72AoMhUoE8d5w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/web-pixels-manager"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/web-pixels-manager/v/76.2.4"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-v6gx-6p2r-f6pp"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"40708b047a1e820aff7a4d44de8f6853274049ca31a4e21f3d05a9f9abc4506c"},"note":"preinstall script: node index.js","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"8660426b963fecb43ff1911416a52a3679afc81781a279a1efa5001229116005"},"note":"Executed by the preinstall script of web-pixels-manager@76.2.4.","paths":["index.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://realwbx.com/ip.php"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021780","import_time":"2026-10-26T06:39:42.497273142Z","modified_time":"2026-10-26T06:31:56Z","sha256":"2a75cc1a77f4f7dce3f84c9b66aa2613ace8bccab0fffa5587a4a30ce9fdc71a","source":"amazon-inspector","versions":["76.2.4"]},{"id":"GHSA-v6gx-6p2r-f6pp","import_time":"2026-11-03T22:17:46.4902033Z","modified_time":"2026-11-03T22:14:25Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"e356a18310639c31ebdb57fc6d325752ec05061c9e0db1892b1f013800d141c1","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}