rootaccessxvv-bbmarker

GHSA-qhhh-x4xj-h3j3

Malicious code in rootaccessxvv-bbmarker (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.2`

## Source: amazon-inspector (126c6e67bc80ed62f5e620ef9a8ce11ca39653348a59bc8d7a1d0cef76f72a02)
package.json declares a postinstall lifecycle script that runs on `npm install` and POSTs installer host identifiers to a hardcoded webhook.site collector at https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The script shells out to `whoami`, `hostname`, `uname`, and `node -v`, concatenates the output with the current working directory, and sends the result via `curl -X POST`. The destination is an anonymous third-party webhook aggregator unrelated to any legitimate install-time dependency. The package name self-describes as a proof-of-concept, but the behavior — automatic install-time collection and exfiltration of installer identity and host metadata to an attacker-controlled collector — is a working supply-chain attack regardless of how it is labeled.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/81ac4155842b3844327d024efe2779bfadf052fd/osv/malicious/npm/rootaccessxvv-bbmarker/MAL-2026-18108.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/81ac4155842b3844327d024efe2779bfadf052fd/osv/malicious/npm/rootaccessxvv-bbmarker/MAL-2026-18108.json
- https://www.npmjs.com/package/rootaccessxvv-bbmarker/v/1.0.2
- https://github.com/ossf/malicious-packages/blob/f602880a537e03ea87f685304f3a8f41caecb03c/osv/malicious/npm/rootaccessxvv-bbmarker/MAL-2026-18108.json
- https://www.npmjs.com/package/rootaccessxvv-bbmarker
- https://github.com/advisories/GHSA-qhhh-x4xj-h3j3

Compromised versions (1)

= 1.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.