OpenSSF/OSV advisory MAL-2026-12496 confirms this npm version as malicious. package.json declares preinstall and postinstall lifecycle scripts that run curl against https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e with query-string parameters carrying the installer's username (`whoami`), hostname, current working directory ($PWD), and a timestamp. Both hooks fire automatically during `npm install` with no opt-in, delivering host reconnaissance data to an attacker-controlled...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in voicemail (npm)
Details
package.json declares preinstall and postinstall lifecycle scripts that run curl against https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e with query-string parameters carrying the installer's username (`whoami`), hostname, current working directory ($PWD), and a timestamp. Both hooks fire automatically during `npm install` with no opt-in, delivering host reconnaissance data to an attacker-controlled webhook.site inbox. The package has no legitimate library content justifying this behavior; the lifecycle hooks are the payload.
Decision reason
OpenSSF Malicious Packages via OSV confirms voicemail@1.0.1 as malicious (MAL-2026-12496): Malicious code in voicemail (npm)