OpenSSF/OSV advisory MAL-2026-13920 confirms this npm version as malicious. The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect installer-side reconnaissance: os.hostname(), the output of shell commands id, hostname -I, ip addr, ls /, ls -a $HOME, and getent hosts internal.twilio.com; environment values including HOME and the npm registry; presence and auth-flag checks for ~/.npmrc at multiple paths (HOME, /root, /usr/etc, /etc,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in bb-twl-k7x2 (npm)
Details
The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect installer-side reconnaissance: os.hostname(), the output of shell commands id, hostname -I, ip addr, ls /, ls -a $HOME, and getent hosts internal.twilio.com; environment values including HOME and the npm registry; presence and auth-flag checks for ~/.npmrc at multiple paths (HOME, /root, /usr/etc, /etc, parent paths) testing for _auth, _authToken, and password tokens; presence of ~/.aws and ~/.aws/credentials; and an AWS instance metadata service probe at http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve the IAM role name. The collected fields are transmitted via HTTP GET query string to http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d/. The package name and self-description as a bug-bounty canary do not change the observed behavior: credential-path reconnaissance and host enumeration on the installer's machine, sent over plain HTTP to a hardcoded third-party host, on any npm install of this package.
Decision reason
OpenSSF Malicious Packages via OSV confirms bb-twl-k7x2@1.0.1 as malicious (MAL-2026-13920): Malicious code in bb-twl-k7x2 (npm)