MAL-2026-14117 Malicious code in bcc-design (npm)
Malicious package
Published
MAL-2026-14117 is a malicious package: bcc-design (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-14117/ (Markdown: https://insights.sbomify.com/MAL-2026-14117/index.md)
- Package
- bcc-design
- Registry
- npm
What is MAL-2026-14117?
MAL-2026-14117 is a malicious package in bcc-design, published on 18 Aug 2026.
Official description
[email protected] is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm install, its postinstall lifecycle script executes notify.js, which reads os.hostname() and issues an HTTP GET to the hardcoded bare-IP endpoint http://91.201.215.48:8000/npm-poc-bcc carrying the installer's hostname, the package name, and a timestamp as query parameters. A second network reference to webhook.site is present in the same file. The package provides no legitimate library functionality; its only install-time effect is transmitting installer identity to an attacker-controlled destination.
What should I do about MAL-2026-14117?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.
Sources
Also known as GHSA-v36x-48h2-hc4f, SNYK-JS-BCCDESIGN-19003146.