🛡️ MAL-2026-12478 — test22221

Malicious code in test22221 (npm)

Source: amazon-inspector

package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTTP at 54.37.234.136, sending the installer's username (whoami), hostname, current working directory, and a timestamp as query-string parameters to http://54.37.234.136/voicemail. The same lifecycle scripts also embed an unbounded for((i=1;;i++)) loop that repeatedly curls incrementing paths on the same host with a 10-second sleep, functioning as a long-poll channel to the attacker-controlled endpoint during install. The destination is a bare IP with no relationship to any package publisher domain, and the collected fields are host-identification data with no legitimate purpose in an install hook.