test2221@2.2.3

Analysis

The package contains no executable code — only a package.json file. Both the preinstall and postinstall hooks execute a curl command that collects system information (username via whoami, hostname, current working directory, and directory listing) and sends it to hxxp://54[.]37[.]234[.]136/voicemail as query parameters. The data is exfiltrated on every npm install.