{"answers":{"affected":"1 open source package ship an affected version, including idlive-face-capture-web-development.","exploited":"There is no known exploitation of MAL-2026-17894 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17894 is a malicious package in idlive-face-capture-web-development, published on 15 Oct 2026."},"fix_prompt":"MAL-2026-17894 is a malicious package: idlive-face-capture-web-development (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17894/ (Markdown: https://insights.sbomify.com/MAL-2026-17894/index.md)","id":"MAL-2026-17894","markdown":"https://insights.sbomify.com/MAL-2026-17894/index.md","name":"MAL-2026-17894","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"idlive-face-capture-web-development@78.8.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `a3b620ea8719eae2fa9b62726364bcc9`, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.\n\nPackage declares scripts.preinstall=\"node index.js\", which on npm install unconditionally issues an HTTPS GET to https://realwbx.com/ip.php with a hardcoded Authorization token, revealing the installer's public IP, User-Agent, and install timing to a third-party host unrelated to the package's declared publisher. Package identity is inconsistent in ways typical of a dependency-confusion/typosquat probe: the package name is idlive-face-capture-web-development, the README body is fiji-core-foundation, the description says \"for get the IP location and metadata\", and the author (conx3993) and keywords do not correspond to any legitimate face-capture SDK. Installing this package produces an attacker-controlled callback confirming successful execution on the victim host.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in idlive-face-capture-web-development (npm)","id":"MAL-2026-17894","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"idlive-face-capture-web-development","purl":"pkg:npm/idlive-face-capture-web-development","source":"MAL-2026-17894"}],"products":null,"published":"2026-10-15","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17894/"}