OpenSSF/OSV advisory MAL-2026-12496 confirms this npm version as malicious. package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint (https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots) with query parameters carrying the installer's username ($(whoami)), hostname ($(hostname)), current working directory ($PWD), and a timestamp...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in voicemail (npm)
Details
package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint (https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots) with query parameters carrying the installer's username ($(whoami)), hostname ($(hostname)), current working directory ($PWD), and a timestamp. The beacon fires automatically on `npm install` without user consent, sending host and identity reconnaissance to an attacker-controlled collector. The package provides no legitimate functionality corresponding to this network activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms voicemail@1.0.2 as malicious (MAL-2026-12496): Malicious code in voicemail (npm)