🛡️ MAL-2026-12813 — twilio-functions

Malicious code in twilio-functions (npm)

Source: amazon-inspector

On npm install, the package's postinstall script executes index.js, which collects host identifiers (os.hostname(), os.userInfo().username, os.homedir(), process.cwd(), os.platform(), os.arch(), and selected environment variables) and POSTs them as JSON to a hardcoded webhook.site collection URL (https://webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f). On network error, the code falls back to a DNS callback against an interactsh-style subdomain at 2b22ede784d5.oast.fun. Package metadata (name twilio-functions mimicking the Twilio SDK namespace, version 99.99.99, empty description) is consistent with a typosquat / dependency-confusion lure whose only on-install effect is the outbound reconnaissance beacon.