Is idlive-face-capture-web-development malicious?
Yes. Protet confirmed 1 version of idlive-face-capture-web-development as malicious
First confirmed on 2026-10-22.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 78.8.1 | 2026-10-22 | PROTET-NPM-2026-1 |
What it does
The package runs node index.js from its preinstall script. The script sends an HTTPS GET request to https://realwbx.com/ip.php with a hard-coded Authorization header unique to this package and a fake Node.js User-Agent, which tells the receiving server that the package was installed. The package has no legitimate function: the same maintainer published several packages with internal-looking names and very high version numbers, which matches a dependency-confusion canary campaign.
Impact: the operator of realwbx.com learns that the package was installed and from which network address.
Remediation: remove the package from all projects and lockfiles, pin internal package names to your private registry scope, and review the hosts that installed it.
Indicators
Domainsrealwbx.com
URLshttps://realwbx.com/ip.php
Other reports
- Also reported in OSV as MAL-2026-17894
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-10-22: 78.8.1 named by Protet Intel