{"id":"MAL-2026-18108","summary":"Malicious code in rootaccessxvv-bbmarker (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02)\npackage.json declares a postinstall lifecycle script that runs on `npm install` and POSTs installer host identifiers to a hardcoded webhook.site collector at https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The script shells out to `whoami`, `hostname`, `uname`, and `node -v`, concatenates the output with the current working directory, and sends the result via `curl -X POST`. The destination is an anonymous third-party webhook aggregator unrelated to any legitimate install-time dependency. The package name self-describes as a proof-of-concept, but the behavior — automatic install-time collection and exfiltration of installer identity and host metadata to an attacker-controlled collector — is a working supply-chain attack regardless of how it is labeled.\n","modified":"2026-10-20T19:00:04.374656693Z","published":"2026-10-20T18:45:46Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021550","import_time":"2026-10-20T18:46:13.8136392Z","modified_time":"2026-10-20T18:45:46Z","sha256":"126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02","source":"amazon-inspector","versions":["1.0.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/rootaccessxvv-bbmarker/v/1.0.2"}],"affected":[{"package":{"name":"rootaccessxvv-bbmarker","ecosystem":"npm","purl":"pkg:npm/rootaccessxvv-bbmarker"},"versions":["1.0.2"],"database_specific":{"indicators":{"package_integrity":[{"filename":"rootaccessxvv-bbmarker-1.0.2.tgz","hashes":{"sha512_sri":"sha512-o/xNrAhQezHEJZeP0CZLKEDckNGKCCoyZHBxxJD/eaZv/NNGxo1FnUE+6zctlACyAqZlk+BO+vUpCnSGs1AHlQ==","sha1":"03191f4a841c069d718612feda0b08d262283b07"}}],"evidence_files":[{"path":"package.json","sha256":"949afba7538eb2ff6ba45c2757ff268055e1c2f6ee10d139740dcca424d22913","tlsh":"7901fda7ab04957606f00b7c96629f0afb505b0f85349c0bf2f740a90369ea88793f18"}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rootaccessxvv-bbmarker/MAL-2026-18108.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}