The voicemail npm package versions 1.0.1 and 1.0.2 include lifecycle scripts (preinstall and postinstall) that invoke curl commands to send reconnaissance data—such as the installer's username, hostname, current working directory, and a timestamp—to a hardcoded webhook.site URL controlled by an attacker. This beaconing occurs automatically during npm install, enabling unauthorized data exfiltration. The package itself lacks any legitimate features corresponding to this network behavior, indicating it is a malicious package designed for host and identity reconnaissance.

Installation of the affected voicemail package versions results in unauthorized transmission of sensitive environment information to an attacker-controlled endpoint. This exposure of user and host details can facilitate further targeted attacks or reconnaissance by adversaries. There is no indication of direct code execution beyond the install scripts, but the data leakage itself constitutes a privacy and security risk.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing voicemail versions 1.0.1 and 1.0.2. Verify package authenticity before installation and consider using trusted package sources or integrity verification mechanisms. Monitor for updates or advisories from npm or relevant security authorities regarding this package.