{
 "affected": [
  {
   "package": {
    "ecosystem": "npm",
    "name": "rootaccessxvv-bbmarker"
   },
   "versions": [
    "1.0.2"
   ]
  }
 ],
 "aliases": [
  "MAL-2026-18108"
 ],
 "credits": [
  {
   "contact": [
    "https://protet.io/intel/npm/rootaccessxvv-bbmarker/1.0.2"
   ],
   "name": "Protet",
   "type": "FINDER"
  }
 ],
 "details": "The package runs a `curl` command from its postinstall script. The command sends an HTTP POST to https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof with the user name, host name, Node.js version, the output of `uname -a`, the current working directory and the package name. The text of the request calls itself a remote-code-execution proof from security research. Whatever the intent, the package executes code at install time on the machine and sends information about it to a third-party collector, without the user's knowledge.\n\nImpact: the owner of the webhook learns which hosts and users install the package, together with details of their environment.\n\nRemediation: remove the package from all projects and lockfiles and review the hosts that installed it.",
 "id": "PROTET-NPM-2026-9",
 "modified": "2026-10-22T15:33:16Z",
 "published": "2026-10-22T10:49:06Z",
 "references": [
  {
   "type": "REPORT",
   "url": "https://protet.io/intel/npm/rootaccessxvv-bbmarker/1.0.2"
  }
 ],
 "schema_version": "1.6.0",
 "summary": "Malicious code in rootaccessxvv-bbmarker (npm)"
}