The malicious 'voyager-web' npm package version 999.0.0 contains preinstall and postinstall lifecycle hooks that run a script (callback.js) during npm install. This script gathers host identifiers (hostname, username, user IDs, home directory, platform, current working directory, local and external IP addresses, Node version, package name) and continuous integration environment variables (such as GITHUB_TOKEN, AWS_ACCESS_KEY_ID, NPM_TOKEN, GITHUB_REPOSITORY, GITHUB_ACTOR, JENKINS_URL). It then exfiltrates this data via HTTP POST to a hardcoded Discord webhook URL and has a DNS-based fallback exfiltration method. The package name is a typo-squatting variant of the legitimate 'voyager-web' package from Reddit, and the version 999.0.0 is a known version used to override internal/private packages in dependency confusion attacks. The effect is automatic and silent exfiltration of sensitive data from any system that installs this package.

Any system that installs this package is considered fully compromised due to automatic exfiltration of sensitive host and CI environment data, including secrets and credentials. This can lead to unauthorized access and further compromise of infrastructure. The presence of this package implies that all secrets and keys on the affected system should be rotated immediately. Removal of the package alone does not guarantee remediation as the attacker may have established persistent control.

Remove the malicious 'voyager-web' package version 999.0.0 immediately. Rotate all secrets and credentials that may have been exposed, preferably from a secure, unaffected system. Since this package is a proof-of-concept for dependency confusion attacks, review and harden supply chain security practices to prevent installation of typosquatting or malicious packages. No official patch or fix exists as this is a malicious package rather than a vulnerability in legitimate software.