MAL-2026-18108

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rootaccessxvv-bbmarker/MAL-2026-18108.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18108
Published
2026-10-20T18:45:46Z
Modified
2026-10-20T19:00:04Z
Summary
Malicious code in rootaccessxvv-bbmarker (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02)

package.json declares a postinstall lifecycle script that runs on npm install and POSTs installer host identifiers to a hardcoded webhook.site collector at https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The script shells out to whoami, hostname, uname, and node -v, concatenates the output with the current working directory, and sends the result via curl -X POST. The destination is an anonymous third-party webhook aggregator unrelated to any legitimate install-time dependency. The package name self-describes as a proof-of-concept, but the behavior — automatic install-time collection and exfiltration of installer identity and host metadata to an attacker-controlled collector — is a working supply-chain attack regardless of how it is labeled.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021550",
            "import_time":  "2026-10-20T18:46:13.8136392Z",
            "modified_time":  "2026-10-20T18:45:46Z",
            "sha256":  "126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / rootaccessxvv-bbmarker

Package

Name
rootaccessxvv-bbmarker
View open source insights on deps.dev
Purl
pkg:npm/rootaccessxvv-bbmarker

Affected ranges

Affected versions

1.*
1.0.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "949afba7538eb2ff6ba45c2757ff268055e1c2f6ee10d139740dcca424d22913",
            "tlsh":  "7901fda7ab04957606f00b7c96629f0afb505b0f85349c0bf2f740a90369ea88793f18"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "rootaccessxvv-bbmarker-1.0.2.tgz",
            "hashes":  {
                "sha1":  "03191f4a841c069d718612feda0b08d262283b07",
                "sha512_sri":  "sha512-o/xNrAhQezHEJZeP0CZLKEDckNGKCCoyZHBxxJD/eaZv/NNGxo1FnUE+6zctlACyAqZlk+BO+vUpCnSGs1AHlQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rootaccessxvv-bbmarker/MAL-2026-18108.json"