Malicious Code Injection in xapi-lib Package: A Critical Vulnerability
Summary
MAL-2026-17896: Malicious code in xapi-lib (npm). Affects xapi-lib versions 88.2.3 – 90.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xapi-lib package, available on npm, is designed to retrieve IP location and metadata. It is a lightweight package that primarily serves as a stub, lacking substantial library content. However, it has been compromised with malicious code that executes during installation, posing a significant risk to users.
Vulnerability Detail
The vulnerability arises from a preinstall hook in the xapi-lib package versions 88.2.3, 88.2.5, 90.2.1, and 90.3.1. This hook executes a script that sends an HTTP GET request to a hardcoded external URL (https://realwbx.com/ip.php) with a specific IP address and an Authorization header. This action occurs automatically during the npm install process, which can expose the installer's IP address to an unauthorized third-party server. The malicious nature of this code is underscored by its lack of documentation and the absence of any user-configurable options, making it a severe security threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall xapi-libIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid installing the affected versions of xapi-lib by specifying a version that is known to be safe or by using npm's --ignore-scripts flag during installation: npm install xapi-lib --ignore-scripts.
Conclusion
The xapi-lib package has been compromised with malicious code that executes during installation, posing a significant risk to users. It is essential to update to a patched version or use workarounds to mitigate this vulnerability. Regular monitoring of dependencies using tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for xapi-lib →
FAQ
xapi-lib is an npm package used for retrieving IP location and metadata.
The vulnerability manifests through a preinstall script that sends a request to an external server, exposing the user's IP address.
The affected versions are 88.2.3, 88.2.5, 90.2.1, and 90.3.1.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package, consider using the workaround by installing the package with the --ignore-scripts flag to prevent the malicious code from executing.
