MAL-2026-11159 Malicious code in toll_free (npm)

package.json declares both preinstall and postinstall lifecycle hooks that run curl against a hardcoded webhook.site endpoint, sending the installer's username ($(whoami)), hostname ($(hostname)), current working directory ($PWD), and timestamp as query parameters. This fires automatically on npm install, before any code the installer intended to run. webhook.site is a third-party HTTP inspection service used to collect arbitrary request data; the specific endpoint ID is controlled by whoever created it. There is no legitimate functionality shipped with the package that would explain this beacon.

The OpenSSF Package Analysis project identified 'toll_free' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.