# MAL-2026-17895: Malicious code in web-pixels-manager (npm)


- **Type:** Malicious package
- **Package:** `web-pixels-manager` (npm)
- **Published:** 15 Oct 2026

## What is MAL-2026-17895?

MAL-2026-17895 is a malicious package in web-pixels-manager, published on 15 Oct 2026. 

### Official description

web-pixels-manager@76.2.4 describes itself as a package for getting IP location and metadata. Its preinstall hook runs `node index.js` on npm install and requests `https://realwbx.com/ip.php?ip=8.8.8.8` with the hardcoded Authorization value `207e4133bd083b9e3e89c5556fc8677e`, which differs from the value in each of the account's other packages. The npm account conx3993 published it on 2026-10-15, one of 9 packages from that account between 2026-09-30 and 2026-10-15 whose preinstall hook calls realwbx.com.

Package name `web-pixels-manager` typosquats Shopify's scoped `@shopify/web-pixels-manager`; the stated description (`get the IP location and metadata`) is unrelated to that name and the README is a one-line stub. `package.json` declares `preinstall: node index.js`, and `index.js` executes top-level code on `npm install` that performs an HTTPS GET to `https://realwbx.com/ip.php` with a hardcoded `Authorization` bearer token (via `getPublicIPLocation('8.8.8.8')`). The destination is not a Shopify or publisher-matching host. The install-time outbound call allows the operator of realwbx.com to enumerate hosts that installed the package, timestamp them, and correlate them to the hardcoded token, providing a victim check-in channel under a typosquatted name.

## What should I do about MAL-2026-17895?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17895 is a malicious package: web-pixels-manager (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17895/ (Markdown: https://insights.sbomify.com/MAL-2026-17895/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17895

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17895/
Summaries are generated and may contain mistakes; the official description above is the record.