OpenSSF/OSV advisory MAL-2026-14117 confirms this npm version as malicious. bcc-design@9999.0.0 is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm install, its postinstall lifecycle script executes notify.js, which reads os.hostname() and issues an HTTP GET to the hardcoded bare-IP endpoint http://91.201.215.48:8000/npm-poc-bcc carrying the installer's hostname, the package name, and a timestamp as query parameters...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bcc-design (npm)
Details
bcc-design@9999.0.0 is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm install, its postinstall lifecycle script executes notify.js, which reads os.hostname() and issues an HTTP GET to the hardcoded bare-IP endpoint http://91.201.215.48:8000/npm-poc-bcc carrying the installer's hostname, the package name, and a timestamp as query parameters. A second network reference to webhook.site is present in the same file. The package provides no legitimate library functionality; its only install-time effect is transmitting installer identity to an attacker-controlled destination.
Decision reason
OpenSSF Malicious Packages via OSV confirms bcc-design@9999.0.0 as malicious (MAL-2026-14117): Malicious code in bcc-design (npm)