xapi-lib 90.2.1

Details

The package runs node index.js from its preinstall script. The script sends an HTTPS GET request to https://realwbx.com/ip.php with a hard-coded Authorization header unique to this package and a fake Node.js User-Agent, which tells the receiving server that the package was installed. The package has no legitimate function: the same maintainer published several packages with internal-looking names and very high version numbers, which matches a dependency-confusion canary campaign.

Impact: the operator of realwbx.com learns that the package was installed and from which network address.

Remediation: remove the package from all projects and lockfiles, pin internal package names to your private registry scope, and review the hosts that installed it.