MalwarePublished 5 Aug 2026Updated 24 Sep 2026

voicemail (npm) · Malicious Code

Affects voicemailSource GCVE Database

Malicious package : remove voicemail and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12496

What to do

Remove voicemail from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmvoicemail	Affected =1.0.1 =1.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f) package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint (https://webhook.site/d80b4602-8a87-4693-8510-6ff77c62788e/blots) with query parameters carrying the installer's username ($(whoami)), hostname ($(hostname)), current working directory ($PWD), and a timestamp. The beacon fires automatically on `npm install` without user consent, sending host and identity reconnaissance to an attacker-controlled collector. The package provides no legitimate functionality corresponding to this network activity.

Impact

Installation of the affected voicemail package versions results in unauthorized transmission of sensitive environment information to an attacker-controlled endpoint. This exposure of user and host details can facilitate further targeted attacks or reconnaissance by adversaries. There is no indication of direct code execution beyond the install scripts, but the data leakage itself constitutes a privacy and security risk.

Defensive guidance

Users should avoid installing voicemail versions 1.0.1 and 1.0.2. Verify package authenticity before installation and consider using trusted package sources or integrity verification mechanisms. Monitor for updates or advisories from npm or relevant security authorities regarding this package.

Summary

The voicemail npm package versions 1.0.1 and 1.0.2 include lifecycle scripts (preinstall and postinstall) that invoke curl commands to send reconnaissance data—such as the installer's username, hostname, current working directory, and a timestamp—to a hardcoded webhook.site URL controlled by an attacker. This beaconing occurs automatically during npm install, enabling unauthorized data exfiltration. The package itself lacks any legitimate features corresponding to this network behavior, indicating it is a malicious package designed for host and identity reconnaissance.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 15:36 UTC

Technical details

References

Community reviews