MAL-2026-14117

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bcc-design/MAL-2026-14117.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14117
Published
2026-08-18T04:46:41Z
Modified
2026-08-18T05:02:40.864286086Z
Summary
Malicious code in bcc-design (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80)

bcc-design@9999.0.0 is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm install, its postinstall lifecycle script executes notify.js, which reads os.hostname() and issues an HTTP GET to the hardcoded bare-IP endpoint http://91.201.215.48:8000/npm-poc-bcc carrying the installer's hostname, the package name, and a timestamp as query parameters. A second network reference to webhook.site is present in the same file. The package provides no legitimate library functionality; its only install-time effect is transmitting installer identity to an attacker-controlled destination.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-18T04:47:05.209205928Z",
            "sha256": "d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80",
            "modified_time": "2026-08-18T04:46:41Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017985",
            "versions": [
                "9999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bcc-design

Package

Name
bcc-design
View open source insights on deps.dev
Purl
pkg:npm/bcc-design

Affected ranges

Affected versions

9999.*
9999.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bcc-design/MAL-2026-14117.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "eadc6249aacea04ac67f781f473a0140fef1fd0f685323cf2b6e61f5abe22010",
            "path": "notify.js",
            "tlsh": "96f02bf981f4515830e159c8b35296a2f111d141b85ad2c0ff8e23616fc6c7586b35e8"
        }
    ],
    "package_integrity": [
        {
            "filename": "bcc-design-9999.0.0.tgz",
            "hashes": {
                "sha1": "b1b9e2cc7f25616a1bf592cd06f6f34bdbb9b6d5",
                "sha512_sri": "sha512-RJtrDpp4H4D4giJ7ZQzcTeA9RlwmmKYG/IsH2viONZZ6L5LUCpWRV+T4mkx9prf4a9Rt4g6Tvn77Ta4Fqn5elg=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]