Malicious Code Vulnerability in xblaxw Package: Data Exfiltration Risk
Summary
MAL-2026-17708: Malicious code in xblaxw (npm). Affects xblaxw versions 1.0.0 – 99.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xblaxw package, available on npm, is described as a 'Compatibility shim.' However, it serves no real functionality and is essentially a stub package. Its primary behavior is to act as a beacon, collecting sensitive host identifiers and sending them to a hardcoded IP address over plaintext HTTP. This raises significant security concerns for users who may unknowingly include it in their projects.
Vulnerability Detail
The vulnerability stems from the xblaxw package's postinstall script, which executes a beacon script that collects sensitive information such as hostname, install path, current working directory, and Node.js version. This data is then sent to a remote server at http://185.158.107.175:8787. The malicious behavior is triggered not only during installation but also whenever the package is imported, making it a persistent threat. The use of a Proxy to return no-op functions for property access further obscures its malicious intent, making it a classic example of dependency confusion and name-squatting.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall xblaxwIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the xblaxw package altogether. If it is a dependency of another package, consider removing that package or replacing it with a safer alternative. Additionally, you can monitor your project for any instances of the xblaxw package using tools like Vulert, which can analyze your package-lock.json file for vulnerabilities.
Conclusion
The xblaxw package poses a significant security risk due to its malicious code that collects and exfiltrates sensitive information. Users are strongly advised to update to a patched version or remove the package entirely to mitigate potential threats. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your projects.
See every vulnerability recorded for xblaxw →
FAQ
The xblaxw package is an npm package that acts as a stub with no real functionality, primarily designed to collect and exfiltrate sensitive host information.
The vulnerability manifests through a postinstall script that runs a beacon script, which collects sensitive data and sends it to a remote server whenever the package is installed or imported.
The risks include unauthorized data exfiltration, potential exposure of sensitive information, and the possibility of further attacks on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider removing it or replacing it with a safer alternative. Additionally, monitor your project for vulnerabilities using tools like Vulert.
