The npm package 'voyager-web' version 999.0.0 is a malicious typosquatting package that executes code during installation to exfiltrate sensitive host and CI environment information to an attacker-controlled Discord webhook. It collects system identifiers and CI secrets and sends them without consent. This package is a proof-of-concept for dependency confusion attacks but results in full compromise of any system where it is installed.