The bb-twl-k7x2 npm package (versions 1.0.0 and 1.0.1) includes install and postinstall lifecycle scripts (canary.js) that execute automatically upon npm install. These scripts gather detailed reconnaissance data from the host environment, including OS hostname, output of shell commands (id, hostname -I, ip addr, directory listings), environment variables (HOME, npm registry), and checks for presence and contents of credential files such as ~/.npmrc and AWS credentials. Additionally, it probes the AWS instance metadata service to retrieve IAM role information. All collected data is transmitted over plain HTTP to a fixed external URL (http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d/), exposing sensitive information to a third party. The package's naming and description do not mitigate or alter this behavior.

This malicious behavior can lead to unauthorized disclosure of sensitive environment and credential information from the installer's machine. Exposure of npm authentication tokens, AWS credentials, and host network details can facilitate further compromise or unauthorized access to cloud resources and developer environments. The use of unencrypted HTTP for data exfiltration increases the risk of interception. There is no indication of active exploitation in the wild at this time.

Users should avoid installing the bb-twl-k7x2 package versions 1.0.0 and 1.0.1. Since no patch or fix is indicated, removal of the package and auditing of any credentials potentially exposed during installation is recommended. Consider rotating any npm or AWS credentials that may have been compromised. Use trusted and verified packages from official sources and monitor for suspicious network activity during package installations.