The 'test2221' npm package versions 2.2.3, 2.2.4, and 2.2.6 include preinstall and postinstall scripts declared in package.json that execute curl commands to http://54.37.234.136/voicemail. These scripts transmit installer host identifiers including the username, hostname, working directory, and a timestamp as query parameters. This unauthorized data exfiltration occurs automatically during 'npm install' and is unrelated to the package's documented functionality. The behavior matches reconnaissance beacon patterns suitable for subsequent targeted attacks. The OpenSSF Package Analysis project identified this package as malicious due to execution of commands associated with malicious behavior.

Installation of affected versions of the 'test2221' package results in automatic transmission of sensitive host information to a remote attacker-controlled server. This exposure of environment details can facilitate targeted follow-on attacks against the installer's system. No direct code execution or system compromise beyond data exfiltration is described in the source data.

No official patch or remediation is documented for this package. Users should avoid installing the affected versions (=2.2.3, =2.2.4, =2.2.6) of 'test2221'. Review and remove the package if already installed. Monitor for suspicious network activity related to the IP address 54.37.234.136. Consider using trusted package sources and verifying package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.