Malicious code in rootaccessxvv-bbmarker (npm)

The 'rootaccessxvv-bbmarker' npm package version 1.0.2 declares a postinstall lifecycle script that executes on 'npm install'. This script runs system commands ('whoami', 'hostname', 'uname', 'node -v'), concatenates their output with the current working directory, and sends the collected information via an HTTP POST request to a hardcoded third-party webhook.site URL. The destination is unrelated to any legitimate dependency, indicating unauthorized data exfiltration. Although labeled as a proof-of-concept, the package effectively performs a supply-chain attack by collecting and transmitting installer host metadata automatically during installation.

The malicious postinstall script leaks sensitive host and environment information to an attacker-controlled endpoint. This can lead to privacy violations and potentially aid attackers in further targeting or reconnaissance. The automatic execution during package installation increases the risk of widespread data exposure if the package is used in development or production environments.

No official patch or remediation is currently documented. Users should avoid installing the 'rootaccessxvv-bbmarker' package version 1.0.2. Review and audit npm dependencies for unauthorized or suspicious postinstall scripts. Consider using package integrity verification tools and restrict installation of untrusted packages to mitigate supply-chain risks.