Malicious npm package rootaccessxvv-bbmarker — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-03
GitHub's advisory database published a malware advisory (GHSA-j3h4-5jwm-6m55) for the npm package rootaccessxvv-bbmarker, classified under CWE-506 (Embedded Malicious Code). Every published version (= 0) is affected and no patched version exists — the package itself is the malware. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity. All secrets and keys on affected machines are at risk of theft. There is no fix; remediation consists of removing the package and rotating credentials from a clean machine, though removal cannot guarantee elimination of all malicious software planted during installation.
What to do
- Treat any machine with rootaccessxvv-bbmarker installed as fully compromised
- Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer
- Remove the package and rebuild/reimage affected systems where possible
- Audit dependency trees and lockfiles for the package and block it in registries/CI
- Review access logs and network activity for signs of attacker control
Sources
All live incidents on Threat Watch
