xapi-lib@90.3.1

Summary

xapi-lib@88.2.3 declares preinstall: node index.js in package.json, and index.js performs an unconditional top-level HTTPS GET to realwbx.com/ip.php (passing 8.8.8.8 and a hardcoded Authorization header) on load. The call fires automatically during npm install, sending the installer's source IP to a hardcoded non-publisher endpoint unrelated to any advertised functionality. The package itself is a one-file stub with no library content, so dependency resolution plus the preinstall beacon is the entire effect of installing it. The destination realwbx.com is not a publisher-aligned domain, the request is not caller-configurable, and no documentation discloses the outbound call.

Source: amazon-inspector (beac62be73c115f383ea095cc364879294d6c105817d3c0eb6bfb30ce7bcf46c)