monkey-tags-ip@53.4.1

Summary

monkey-tags-ip@53.4.1 is a stub package whose entire behavior is an install-time beacon. The preinstall script executes node ip.js, which unconditionally makes an HTTPS GET to the hardcoded host realwbx.com/ip?f=json with a hardcoded Bearer token on every npm install, disclosing the installer's source IP and install event to a destination unrelated to the package publisher. The manifest also declares a runtime dependency on a registry package named https (^1.0.0), while the code uses Node's built-in https module; this shadows the built-in name with whatever bytes the registry serves for https, resolving and installing third-party code the package does not own. The package has no legitimate functionality — the beacon and the confusable dependency are its sole content.

Source: amazon-inspector (156e7f5f47312f5f7cd43584abd568920027ab28b6e98f2b65f22cd6a2c4141f)