Malicious Code Exposure in idlive-face-capture-web-development Package
Summary
MAL-2026-17894: Malicious code in idlive-face-capture-web-development (npm). Affects idlive-face-capture-web-development versions 78.8.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The idlive-face-capture-web-development package, version 78.8.1, is designed to provide IP location and metadata services. However, it has been found to contain malicious code that executes during the installation process, compromising user privacy by sending sensitive information to an external server.
Vulnerability Detail
The vulnerability arises from a preinstall hook in the package that executes 'node index.js' during npm install. This script makes an HTTPS GET request to 'https://realwbx.com/ip.php' with a hardcoded Authorization token, exposing the installer's public IP address, User-Agent, and installation timing to a third-party server. This behavior is indicative of malicious intent, as it collects sensitive user data without consent and is inconsistent with the package's stated purpose.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall idlive-face-capture-web-developmentIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid installing the idlive-face-capture-web-development package until a secure version is released. You can also use the following command to remove the package: npm uninstall idlive-face-capture-web-development.
Conclusion
The idlive-face-capture-web-development package contains a serious vulnerability that exposes user data to a malicious third party. Immediate action is required to mitigate the risks associated with this package. Users are advised to uninstall the package and monitor for updates or alternatives.
See every vulnerability recorded for idlive-face-capture-web-development →
FAQ
The vulnerability involves malicious code that collects sensitive user information during installation.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Uninstall the package immediately using 'npm uninstall idlive-face-capture-web-development' and consider using a secure alternative.
As of now, there is no patched version available. Monitor the package repository for updates.
Leaving this vulnerability unaddressed can lead to unauthorized data collection and potential misuse of sensitive information.
