bb-twl-k7x2

{"modified":"2026-08-12T15:55:03Z","published":"2026-08-12T15:40:45Z","schema_version":"1.7.4","id":"MAL-2026-13920","summary":"Malicious code in bb-twl-k7x2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8)\nThe package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect installer-side reconnaissance: os.hostname(), the output of shell commands id, hostname -I, ip addr, ls /, ls -a $HOME, and getent hosts internal.twilio.com; environment values including HOME and the npm registry; presence and auth-flag checks for ~/.npmrc at multiple paths (HOME, /root, /usr/etc, /etc, parent paths) testing for _auth, _authToken, and password tokens; presence of ~/.aws and ~/.aws/credentials; and an AWS instance metadata service probe at http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve the IAM role name. The collected fields are transmitted via HTTP GET query string to http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d/. The package name and self-description as a bug-bounty canary do not change the observed behavior: credential-path reconnaissance and host enumeration on the installer's machine, sent over plain HTTP to a hardcoded third-party host, on any npm install of this package.\n","affected":[{"package":{"ecosystem":"npm","name":"bb-twl-k7x2"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"canary.js","sha256":"b865cf1f7dc75332ae09811e0c9dc3b0b82ba7c07a0c1dcc6db73444a4bda20f","tlsh":"a411639bc0fc603c22f1a5c1311646a3d9a3e2541305e4f0b4a8a0422fe657a6773aea"},{"path":"package.json","sha256":"8d562b6f16fa75ce672276ff7fb3db3e715d1ddf37c73eba01334546dca3da8d","tlsh":"44d02b905801533b34c08beb1ca9c149a130de1f2048a83cdbe7158cc2977b7267bb5f"}],"package_integrity":[{"filename":"bb-twl-k7x2-1.0.0.tgz","hashes":{"sha1":"ace621c334139aa6a8da1b782a69bda852f2ce26","sha512_sri":"sha512-Zi/kWLcc8IC4HxlVED8vSLtraGo7LMQuPdx1zHKj9k4oOulIa/1LgJMoD+ICfrlEHR/BCOFiaesfAtHmWaaxfw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bb-twl-k7x2/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/bb-twl-k7x2/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017616","import_time":"2026-08-12T15:53:01.2399004Z","modified_time":"2026-08-12T15:40:52Z","sha256":"4c87c799fd2fe00ed4cfc7cb42b375a08e0fd38c5d2bc10179e5da21ccf07a47","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-017615","import_time":"2026-08-12T15:53:01.13620003Z","modified_time":"2026-08-12T15:40:45Z","sha256":"7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8","source":"amazon-inspector","versions":["1.0.1"]}]}}