Malicious Code Injection in monkey-tags-ip Package
Summary
MAL-2026-17875: Malicious code in monkey-tags-ip (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The monkey-tags-ip package is an npm library that is designed to assist with IP geolocation functionalities. However, it has been compromised through a dependency confusion attack, where a malicious version of the package has been published to exploit users with misconfigured package resolvers. This vulnerability allows attackers to execute harmful code during the installation process.
Vulnerability Detail
The vulnerability arises from a malicious code injection in the monkey-tags-ip package, specifically in version 53.4.1. An npm user named 'conx3993' published this package as part of a dependency confusion campaign, squatting on a name that resembles an internal package. The malicious version contains a 'preinstall' hook that executes 'ip.js', which sends a request to an attacker-controlled server (realwbx.com) with the victim's public IP address and a hard-coded authorization token. This allows the attacker to track which internal package was installed by the victim, posing significant privacy and security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall monkey-tags-ipIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the monkey-tags-ip package altogether and look for alternative libraries that provide similar functionality without the associated risks. Additionally, ensure that your package manager is configured correctly to prevent dependency confusion.
Conclusion
The monkey-tags-ip package has been compromised through a dependency confusion attack, leading to the injection of malicious code that can expose users' IP addresses. It is crucial to remove this package and replace it with a legitimate alternative to mitigate security risks.
See every vulnerability recorded for monkey-tags-ip →
FAQ
Dependency confusion occurs when an attacker publishes a package with the same name as an internal package, tricking package managers into installing the malicious version instead of the legitimate one.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
If you have installed the monkey-tags-ip package, immediately uninstall it and replace it with a legitimate alternative. Review your code for any potential security breaches.
The malicious code in the monkey-tags-ip package sends a request to an attacker-controlled server with the user's public IP address and a unique authorization token, allowing the attacker to track installations.
The primary risks include exposure of sensitive information, such as the user's public IP address, and potential unauthorized access to internal systems if the package is used in a corporate environment.
