OpenSSF/OSV advisory MAL-2026-14119 confirms this npm version as malicious. bcc-design-icons@9999.0.0 declares a postinstall script `node./notify.js` that runs automatically on `npm install`. The script performs an HTTP GET to the hardcoded bare-IP endpoint http://91.201.215.48:8000/npm-poc-bcc with query parameters containing `os.hostname()` and the package name. The 9999.0.0 version, absence of any icon-library functionality expected from the package name, and callback-to-bare-IP shape...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bcc-design-icons (npm)
Details
bcc-design-icons@9999.0.0 declares a postinstall script `node./notify.js` that runs automatically on `npm install`. The script performs an HTTP GET to the hardcoded bare-IP endpoint http://91.201.215.48:8000/npm-poc-bcc with query parameters containing `os.hostname()` and the package name. The 9999.0.0 version, absence of any icon-library functionality expected from the package name, and callback-to-bare-IP shape match a dependency-confusion attack that identifies internal/private installers to the operator. Hostname is host-identifying data exfiltrated to an attacker-controlled destination without any installer opt-in.
Decision reason
OpenSSF Malicious Packages via OSV confirms bcc-design-icons@9999.0.0 as malicious (MAL-2026-14119): Malicious code in bcc-design-icons (npm)