{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "xapi-lib"
   },
   "versions": [
    "90.2.1"
   ]
  }
 ],
 "aliases": [
  "MAL-2026-17896"
 ],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/xapi-lib/90.2.1"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "The package runs `node index.js` from its preinstall script. The script sends an HTTPS GET request to https://realwbx.com/ip.php with a hard-coded Authorization header unique to this package and a fake Node.js User-Agent, which tells the receiving server that the package was installed. The package has no legitimate function: the same maintainer published several packages with internal-looking names and very high version numbers, which matches a dependency-confusion canary campaign.\n\nImpact: the operator of realwbx.com learns that the package was installed and from which network address.\n\nRemediation: remove the package from all projects and lockfiles, pin internal package names to your private registry scope, and review the hosts that installed it.",
 "id": "PROTET-NPM-2026-3",
 "modified": "2026-10-22T15:33:16Z",
 "published": "2026-10-22T10:49:06Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/xapi-lib/90.2.1"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Malicious code in xapi-lib (npm)"
}