{"answers":{"affected":"1 open source package ship an affected version, including bcc-design.","exploited":"There is no known exploitation of MAL-2026-14117 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14117 is a malicious package in bcc-design, published on 18 Aug 2026."},"fix_prompt":"MAL-2026-14117 is a malicious package: bcc-design (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14117/ (Markdown: https://insights.sbomify.com/MAL-2026-14117/index.md)","id":"MAL-2026-14117","markdown":"https://insights.sbomify.com/MAL-2026-14117/index.md","name":"MAL-2026-14117","record":{"aliases":["GHSA-v36x-48h2-hc4f","SNYK-JS-BCCDESIGN-19003146"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"bcc-design@9999.0.0 is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm install, its postinstall lifecycle script executes notify.js, which reads os.hostname() and issues an HTTP GET to the hardcoded bare-IP endpoint http://91.201.215.48:8000/npm-poc-bcc carrying the installer's hostname, the package name, and a timestamp as query parameters. A second network reference to webhook.site is present in the same file. The package provides no legitimate library functionality; its only install-time effect is transmitting installer identity to an attacker-controlled destination.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bcc-design (npm)","id":"MAL-2026-14117","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bcc-design","purl":"pkg:npm/bcc-design","source":"MAL-2026-14117"}],"products":null,"published":"2026-08-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14117/"}