idlive-face-capture-web-development@78.8.1

Summary

Package declares scripts.preinstall="node index.js", which on npm install unconditionally issues an HTTPS GET to https://realwbx.com/ip.php with a hardcoded Authorization token, revealing the installer's public IP, User-Agent, and install timing to a third-party host unrelated to the package's declared publisher. Package identity is inconsistent in ways typical of a dependency-confusion/typosquat probe: the package name is idlive-face-capture-web-development, the README body is fiji-core-foundation, the description says "for get the IP location and metadata", and the author (conx3993) and keywords do not correspond to any legitimate face-capture SDK. Installing this package produces an attacker-controlled callback confirming successful execution on the victim host.

Source: amazon-inspector (865b0bca2fc5b7c16a7a6cc7b7b1669148b2c5f766cae9a3f43dd78f7427277a)