Malicious Code Vulnerability in web-pixels-manager Package
Summary
MAL-2026-17895: Malicious code in web-pixels-manager (npm). Affects web-pixels-manager versions 76.2.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The web-pixels-manager package, version 76.2.4, is an npm package designed to retrieve IP location and metadata. It is intended for developers who need to access geographical data based on IP addresses. However, this package has been compromised, as it includes a preinstall hook that executes malicious code, potentially exposing users to security risks.
Vulnerability Detail
The vulnerability stems from a preinstall hook in the web-pixels-manager package that runs 'node index.js' during installation. This script makes an unauthorized request to 'https://realwbx.com/ip.php?ip=8.8.8.8' with a hardcoded Authorization token. This behavior indicates the presence of embedded malicious code, which can lead to unauthorized data access and exploitation of user systems. The malicious nature of this code poses significant risks to developers and their applications, as it can compromise sensitive information and lead to further attacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall web-pixels-managerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the web-pixels-manager package until a secure version is released. Additionally, you can manually remove the preinstall script from the package.json file if you still need to use the package for other functionalities. To do this, open your package.json file and remove the line that includes the preinstall script.
Conclusion
The web-pixels-manager package has been identified as containing malicious code that poses a significant security risk. Users are advised to update the package or remove it from their projects until a secure version is released. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for web-pixels-manager →
FAQ
The web-pixels-manager package is an npm package designed to provide IP location and metadata services for developers.
The vulnerability can lead to unauthorized access to sensitive data and may compromise the security of your application.
As of now, there is no patched version available. It is recommended to monitor the package for updates.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to check your application without needing to sign up.
If you cannot update the package, consider removing it from your project or using an alternative package that provides similar functionality without the security risks.
