MalwarePublished 12 Aug 2026

bb-twl-k7x2 (npm) · Malicious Code

Affects bb-twl-k7x2Source GCVE Database

Malicious package : remove bb-twl-k7x2 and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 20:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13920

What to do

Remove bb-twl-k7x2 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbb-twl-k7x2	Affected =1.0.0 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bb-twl-k7x2 versions 1.0.0 and 1.0.1 contains malicious install and postinstall scripts that perform reconnaissance on the installer's machine. These scripts collect system information such as hostnames, network interfaces, directory listings, environment variables, and sensitive credential files including npm and AWS credentials. The collected data is exfiltrated via an unencrypted HTTP GET request to a hardcoded third-party server. Despite the package's self-description as a bug-bounty canary, it performs unauthorized credential-path reconnaissance and host enumeration during installation.

Impact

This malicious behavior can lead to unauthorized disclosure of sensitive environment and credential information from the installer's machine. Exposure of npm authentication tokens, AWS credentials, and host network details can facilitate further compromise or unauthorized access to cloud resources and developer environments. The use of unencrypted HTTP for data exfiltration increases the risk of interception. There is no indication of active exploitation in the wild at this time.

Defensive guidance

Users should avoid installing the bb-twl-k7x2 package versions 1.0.0 and 1.0.1. Consider rotating any npm or AWS credentials that may have been compromised. Use trusted and verified packages from official sources and monitor for suspicious network activity during package installations.

Summary

The bb-twl-k7x2 npm package (versions 1.0.0 and 1.0.1) includes install and postinstall lifecycle scripts (canary.js) that execute automatically upon npm install. These scripts gather detailed reconnaissance data from the host environment, including OS hostname, output of shell commands (id, hostname -I, ip addr, directory listings), environment variables (HOME, npm registry), and checks for presence and contents of credential files such as ~/.npmrc and AWS credentials. Additionally, it probes the AWS instance metadata service to retrieve IAM role information. All collected data is transmitted over plain HTTP to a fixed external URL (http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d/), exposing sensitive information to a third party. The package's naming and description do not mitigate or alter this behavior.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 20:27 UTC

Technical details

References

Community reviews