twilio-hackerone-poc-afe6937c@1.0.0

One or more suspicious static signals were detected.

npm preinstall or postinstall while cwd matches /tmp/AC<32 hex>/

Exposes build topology and execution metadata; creates a temporary background process and mutates a build node_modules tree.

install-time telemetry theft and detached cross-build directory surveillance

On preinstall and postinstall, the package conditionally collects host/process and build metadata, posts it to a third-party webhook, then drops a detached daemon in /tmp. That daemon polls account-scoped build directories, reports foreign directory/service/package identifiers, and can write a marker package to a target build directory. The guard only narrows the target environment; it does not remove the unconsented install-time surveillance, exfiltration, or persistence behavior.

Source confirms a concrete install-time chain of data collection, webhook exfiltration, detached daemon persistence, and cross-build enumeration. The hard-coded environment guard and claimed owned write target do not mitigate the foreign-directory telemetry.