test22221@2.2.9

Summary

package.json declares preinstall and postinstall lifecycle hooks that run on npm install. Both hooks curl a hardcoded bare-IP endpoint over plain HTTP at 54.37.234.136, sending the installer's username (whoami), hostname, current working directory, and a timestamp as query-string parameters to http://54.37.234.136/voicemail. The same lifecycle scripts also embed an unbounded for((i=1;;i++)) loop that repeatedly curls incrementing paths on the same host with a 10-second sleep, functioning as a long-poll channel to the attacker-controlled endpoint during install. The destination is a bare IP with no relationship to any package publisher domain, and the collected fields are host-identification data with no legitimate purpose in an install hook.

Source: amazon-inspector (e4a3401759b5c6d7effdafcbae6027657e3cf8f9aabf1f04dfc2fa9039b64e53)