toll_free@1.0.1

Analysis

toll_free@1.0.1 contains no executable code — only a package.json with preinstall and postinstall hooks that curl a webhook[.]site URL, exfiltrating the installer's username (whoami), hostname, current working directory, and a timestamp. The curl output is discarded and errors suppressed, confirming the sole purpose is reconnaissance and beaconing, not installation. The exfiltration target is webhook[.]site (a webhook testing service commonly abused by malware for C2 callback collection).