rootaccessxvv-bbmarker 1.0.2

Details

The package runs a curl command from its postinstall script. The command sends an HTTP POST to https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof with the user name, host name, Node.js version, the output of uname -a, the current working directory and the package name. The text of the request calls itself a remote-code-execution proof from security research. Whatever the intent, the package executes code at install time on the machine and sends information about it to a third-party collector, without the user's knowledge.

Impact: the owner of the webhook learns which hosts and users install the package, together with details of their environment.

Remediation: remove the package from all projects and lockfiles and review the hosts that installed it.