MAL-2026-17895 Malicious code in web-pixels-manager (npm)

[email protected] describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value 207e4133bd083b9e3e89c5556fc8677e, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.

Package name web-pixels-manager typosquats Shopify's scoped @shopify/web-pixels-manager; the stated description (get the IP location and metadata) is unrelated to that name and the README is a one-line stub. package.json declares preinstall: node index.js, and index.js executes top-level code on npm install that performs an HTTPS GET to https://realwbx.com/ip.php with a hardcoded Authorization bearer token (via getPublicIPLocation('8.8.8.8')). The destination is not a Shopify or publisher-matching host. The install-time outbound call allows the operator of realwbx.com to enumerate hosts that installed the package, timestamp them, and correlate them to the hardcoded token, providing a victim check-in channel under a typosquatted name.