The 'twilio-functions' npm package version 99.99.99 contains malicious code executed during the postinstall phase. This code gathers host identifiers such as hostname, username, home directory, current working directory, platform, architecture, and selected environment variables. It then sends this information as JSON to a hardcoded webhook.site URL. If the network request fails, it performs a DNS callback to an interactsh-style subdomain. The package metadata suggests it is a typosquatting or dependency confusion attempt targeting users expecting the legitimate Twilio SDK.

The malicious package exfiltrates sensitive host environment information to an attacker-controlled endpoint, potentially exposing system details and environment variables. This reconnaissance data could be used for further targeted attacks or exploitation. There is no indication of direct code execution beyond data collection or active exploitation in the wild.

Users should avoid installing the 'twilio-functions' package version 99.99.99 from npm, as it is a malicious typosquatting package. Verify package names carefully before installation to prevent dependency confusion attacks. Since no official patch or fix is available, removing the package and scanning for any data exfiltration indicators is recommended.