Critical Malicious Code Vulnerability in rootaccessxvv-bbmarker Package
Summary
MAL-2026-18108: Malicious code in rootaccessxvv-bbmarker (npm). Affects rootaccessxvv-bbmarker versions 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rootaccessxvv-bbmarker package is an npm module that is designed for use in Node.js applications. It is intended to provide certain functionalities related to package management. However, this package has been found to contain a malicious postinstall script that compromises the security of systems where it is installed. The vulnerability arises from the package's ability to execute arbitrary commands during installation, leading to potential data exfiltration.
Vulnerability Detail
The vulnerability stems from a malicious postinstall script embedded in the rootaccessxvv-bbmarker package. When a user installs this package via npm, the script executes a curl command that sends sensitive information, such as the username, hostname, Node.js version, operating system details, and current working directory, to an attacker-controlled webhook. This behavior constitutes a supply-chain attack, as it collects and exfiltrates installer identity and host metadata without user consent. The npm account responsible for publishing this package is 'mohamed2343224', and it was published on October 18, 2026.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rootaccessxvv-bbmarkerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of the postinstall script by using the following command when installing packages: npm install --ignore-scripts. However, this may not be a viable long-term solution as it could affect other packages that rely on postinstall scripts.
Conclusion
The rootaccessxvv-bbmarker package contains a critical vulnerability due to a malicious postinstall script that exfiltrates sensitive information. Users are advised to uninstall the package immediately and monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for rootaccessxvv-bbmarker →
FAQ
It is an npm package designed for use in Node.js applications, but it has been found to contain malicious code.
The vulnerability allows the package to exfiltrate sensitive information from your system to an attacker-controlled server during installation.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
You should immediately uninstall the rootaccessxvv-bbmarker package using npm uninstall rootaccessxvv-bbmarker.
Always review the packages you install, especially those that execute scripts during installation. Use tools like Vulert to monitor for vulnerabilities.
