voicemail@1.0.1

Analysis

The package contains no executable code — only a package.json with preinstall and postinstall hooks. On install, both hooks execute curl commands that collect the installer's username, hostname, current working directory, and current timestamp, and send them to an attacker-controlled webhook[.]site endpoint (hxxps://webhook[.]site/#!/view/d80b4602-8a87-4693-8510-6ff77c62788e/631f82f2-a730-44e4-9506-e166b5ffcee3/1/voicemail). The package has no repository, no license, and an empty description — its sole purpose is host reconnaissance via lifecycle hooks.