test22221@2.2.9

package.json declares preinstall and postinstall lifecycle hooks that run on `npm install`. Both hooks curl a hardcoded bare-IP endpoint over plain HTTP at 54.37.234.136, sending the installer's username (`whoami`), hostname, current working directory, and a timestamp as query-string parameters to `http://54.37.234.136/voicemail`. The same lifecycle scripts also embed an unbounded `for((i=1;;i++))` loop that repeatedly curls incrementing paths on the same host with a 10-second sleep, functioning as a long-poll channel to the attacker-controlled endpoint during install. The destination is a bare IP with no relationship to any package publisher domain, and the collected fields are host-identification data with no legitimate purpose in an install hook.