Malicious code in twilio-sdk (npm)

The 'twilio-sdk' npm package is a malicious package impersonating the legitimate Twilio SDK ('twilio'). Instead of providing a functional API, it exports an empty module and runs a postinstall script on installation. This script gathers various environment details such as the installer's hostname, DNS-resolved FQDN, Active Directory domain, current working directory, Node.js version, CI environment flags and identifiers, and the configured internal npm registry URL. It then sends this collected information via an unencrypted HTTP GET request to a hardcoded IP address (http://46.224.67.169:3000/ping). This behavior can lead to leakage of sensitive internal infrastructure information, enabling potential downstream targeting such as dependency confusion attacks or lateral movement within compromised environments. The package's README claims it is a 'security research honeypot,' but this does not mitigate the risk to developers who inadvertently install it.

Installation of this package results in the leakage of sensitive internal environment information to an external third party without user consent. This includes internal domain names, CI/CD pipeline identifiers, and internal npm registry URLs, which could facilitate targeted attacks such as dependency confusion or lateral movement within an organization. The package itself does not provide any legitimate functionality, so its presence indicates a supply chain risk and potential reconnaissance activity.

No official patch or remediation is available since this is a malicious package impersonating a legitimate one. The primary mitigation is to avoid installing 'twilio-sdk' and ensure the correct package name 'twilio' is used. Organizations should audit their dependencies to detect and remove this package if present. Developers should verify package names carefully before installation and consider using package allowlists or trusted registries to prevent accidental installation of malicious packages.