thevoid
Ham radio for the internet — terminal-native ephemeral social platform.
This report shows the evidence for thevoid@0.1.4. 2 of 2 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-4692 confirms this npm version as malicious.
Advisory
MAL-2026-4692
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in thevoid (npm)
Details
On install, postinstall.js performs an HTTPS request to void-relay.com carrying process.env contents along with host identifiers (process.platform, process.arch). The destination is not associated with any documented publisher SDK or runtime CDN, and the data exfiltrated (full environment variables plus host fingerprint) constitutes installer-side secret leakage. This matches the canonical hardcoded-C2 exfiltration shape: a lifecycle script (postinstall.js line 38) issues https.get to a hardcoded attacker-controlled host (void-relay.com, line 22) with environment data attached. Any developer or CI runner that installs this package will leak its environment (which routinely contains API tokens, cloud credentials, and CI secrets) to the attacker.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to thevoid@0.1.4.
The same advisory and Firewall decision cover 2 recorded versions
0.1.3, 0.1.4
The versions list below shows the verdict for each recorded version.
- Avoid installing thevoid@0.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.