@mntv-analysis/ui-components@50.1.1
Vulnerability report · Last retrieved from osv.dev October 16, 2026 at 10:11 AM UTC
OSV ID
MAL-2026-17870
Ecosystem
npm
Summary
@mntv-analysis/ui-components@50.1.1 is a hollow package whose only effective behavior on install is a tracking beacon. package.json declares scripts.preinstall: "node index.js", and index.js issues an HTTPS GET to https://realwbx.com/ip.php on npm install, carrying a hardcoded Authorization header value. The scoped @mntv-analysis/* name combined with an implausibly high 50.1.1 version, a placeholder README, no actual UI-component code, and a single-purpose beacon are the canonical dependency-confusion attack shape: the package exists to win internal-package resolution against a private @mntv-analysis scope and to signal successful landing on an installer host. Installation leaks the installer's public IP, timing, and the fact that the attacker's name squat resolved inside the target's build environment to realwbx.com, which is not a vendor endpoint associated with any UI-component library.
Source: amazon-inspector (bd96e684a44e791e753fd73119dd1a2d5b61f2f9fe69b16c86b7a11d9b266fcd)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.