The 'test22221' npm package versions 2.2.7, 2.2.8, and 2.2.9 include preinstall and postinstall hooks that execute commands during 'npm install'. These hooks send the installer's username, hostname, current working directory, and a timestamp as query parameters to a hardcoded bare IP address (http://54.37.234.136/voicemail) over unencrypted HTTP. Additionally, the scripts run an infinite loop that repeatedly sends requests with incrementing paths to the same IP address every 10 seconds, effectively creating a long-polling channel controlled by the attacker. The destination IP is unrelated to any legitimate package publisher domain, indicating malicious intent to collect host-identification data during installation.

The malicious scripts exfiltrate sensitive host information such as username, hostname, and working directory to an attacker-controlled server during package installation. The persistent long-polling connection could be used for command and control or further malicious interactions. This compromises the confidentiality of the host environment and may facilitate further attacks or data leakage.

No official patch or remediation guidance is provided in the available data. Users should avoid installing the affected versions (=2.2.7, =2.2.8, =2.2.9) of the 'test22221' package. If these versions are already installed, remove them and replace them with a clean, verified version once available. Monitor for updates from the package publisher or npm advisories for official fixes.