Malicious code in twilio-voice-js-reference-components (npm)

This malicious npm package mimics the Twilio Voice JS SDK namespace to trick users into installing it. Upon installation, it automatically runs a preinstall script (index.js) without user interaction, which gathers detailed system information and sends it over HTTPS to an attacker-controlled domain. The package metadata is empty or misleading, and it serves as a dependency confusion or typosquatting lure targeting Twilio-related build environments. The presence of this package indicates a full system compromise risk.

Any system that installs this package is at high risk of compromise due to automatic execution of code that collects and exfiltrates sensitive system data. This may lead to exposure of secrets, credentials, and other sensitive information. The attacker may have persistent access, and simply removing the package does not guarantee full remediation. Immediate secret rotation is recommended for affected systems.

Remove the malicious package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted environment. Because the package executes code automatically on install and may have allowed full system compromise, assume persistent threats and conduct thorough incident response. No official patch exists as this is a malicious package rather than a vulnerability in legitimate software.