Is rootaccessxvv-bbmarker malicious?
Yes. Protet confirmed 1 version of rootaccessxvv-bbmarker as malicious
First confirmed on 2026-10-22.
Affected versions
| Version | Confirmed | Protet record |
|---|---|---|
| 1.0.2 | 2026-10-22 | PROTET-NPM-2026-9 |
What it does
The package runs a curl command from its postinstall script. The command sends an HTTP POST to https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof with the user name, host name, Node.js version, the output of uname -a, the current working directory and the package name. The text of the request calls itself a remote-code-execution proof from security research. Whatever the intent, the package executes code at install time on the machine and sends information about it to a third-party collector, without the user's knowledge.
Impact: the owner of the webhook learns which hosts and users install the package, together with details of their environment.
Remediation: remove the package from all projects and lockfiles and review the hosts that installed it.
Indicators
Domainswebhook.site
URLshttps://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof
Other reports
- Also reported in OSV as MAL-2026-18108
What to do if you installed it
- Remove the package from every project that uses it, directly or through another dependency.
- Pin a clean version if you need the package: one that is not listed above and that you have checked yourself, or replace the package. A version missing from this page is not cleared.
- Check your lockfiles (
package-lock.json,yarn.lock,pnpm-lock.yaml) for the affected versions, including as a transitive dependency, and in CI caches. - Rotate credentials that were reachable from any machine or build that installed it: npm and GitHub tokens, cloud keys, SSH keys, and secrets in environment variables or CI settings.
Status history
- 2026-10-22: 1.0.2 named by Protet Intel