Threats Tagged 'mal-2026-5621'
View all threats tagged with 'mal-2026-5621'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'mal-2026-5621'
Click on any threat for detailed analysis and mitigation recommendations
Malicious code in twilio-sdk (npm) 0 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (737fede3d5b2007849cab0503cec191ce127c33c0b28f3b3285f347a064966e1) Package name `twilio-sdk` impersonates the official Twilio Node SDK (`twilio`) but ships an empty API (`module.exports = {}`). The only real behavior runs in postinstall.js, declared via `package.json` `"postinstall": "node./postinstall.js"`. On `npm install`, postinstall.js collects the installer's hostname, DNS-resolved FQDN, Active Directory domain (`USERDNSDOMAIN`), current working directory, Node version, CI flag, and CI/SCM identifiers (`GITHUB_REPOSITORY`, `CIRCLE_*`, `CI_PROJECT_PATH`, `BITBUCKET_REPO_FULL_NAME`, `BUILD_REPOSITORY_URI`, `TRAVIS_REPO_SLUG`, `JENKINS_URL`, `CI_SERVER_URL`), as well as the configured internal npm registry (`npm_config_registry`), and sends them as query parameters in a plaintext HTTP GET to `http://46.224.67.169:3000/ping`. The combination of name-squat against a top-tier SDK, divergent (empty) API, and an unconsented install-time beacon to a hardcoded bare IP is install-time reconnaissance for downstream targeting (dependency-confusion against the leaked internal registry, lateral movement using the leaked AD domain and internal CI URLs). The package's own README labeling it a 'security research honeypot' does not change the installer-side impact: any developer who mistypes `twilio` and installs this package leaks internal infrastructure identifiers to a third-party IP. Join the discussion | GCVE Database | 06/11/2026, 06:13:02 UTC Added: 09/01/2026, 15:45:26 UTC |
Showing 1 to 1 of 1 result