OpenSSF/OSV advisory MAL-2026-4692 confirms this npm version as malicious. On install, postinstall.js performs an HTTPS request to void-relay.com carrying process.env contents along with host identifiers (process.platform, process.arch). The destination is not associated with any documented publisher SDK or runtime CDN, and the data exfiltrated (full environment variables plus host fingerprint) constitutes installer-side secret leakage...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in thevoid (npm)
Details
On install, postinstall.js performs an HTTPS request to void-relay.com carrying process.env contents along with host identifiers (process.platform, process.arch). The destination is not associated with any documented publisher SDK or runtime CDN, and the data exfiltrated (full environment variables plus host fingerprint) constitutes installer-side secret leakage. This matches the canonical hardcoded-C2 exfiltration shape: a lifecycle script (postinstall.js line 38) issues https.get to a hardcoded attacker-controlled host (void-relay.com, line 22) with environment data attached. Any developer or CI runner that installs this package will leak its environment (which routinely contains API tokens, cloud credentials, and CI secrets) to the attacker.
Decision reason
OpenSSF Malicious Packages via OSV confirms thevoid@0.1.4 as malicious (MAL-2026-4692): Malicious code in thevoid (npm)