Malicious code in fmt-util-k7x2 (npm)
fmt-util-k7x2@1.0.1 is a malicious npm package disguised as a string-formatting utility that executes reconnaissance code via a postinstall hook, probing Twilio-internal hostnames and AWS metadata endpoints, then exfiltrating results to an external attacker-controlled domain. This is a targeted dependency-confusion attack aimed at Twilio build environments.
- Disclosed
- Last updated
- Blast radius
- Targeted at Twilio build environments; impact depends on adoption within Twilio's internal dependency chains.
- Ecosystems
- Attack vectors
- Affected entities
- fmt-util-k7x2 · 1.0.1
fmt-util-k7x2@1.0.1 was published to npm as a trivial string-formatting utility, with index.js exporting only two-line pad/trim helper functions. However, the package.json declares a postinstall hook that executes setup.js on every npm install.
The setup.js script performs reconnaissance by probing a list of Twilio-internal hostnames (code.hq.twilio.com, stage.twilio.com, twilio.jfrog.io, artifacts.twilio.com) and the AWS EC2 instance metadata endpoint (169.254.169.254). It then concatenates the per-target reachability results and sends them as a query string to http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d, with a unique per-install UUID callback identifying each victim.
The attack pattern—random-suffix package name, mismatch between advertised functionality and postinstall behavior, targeting of internal corporate hostnames and cloud metadata services—is consistent with a targeted dependency-confusion attack. The exfiltration destination is not owned by Twilio and is unrelated to the package's stated purpose.
The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- fmt-util-k7x2@1.0.1
- Domains
- whstool.brkd.no
Remediation
- Remove fmt-util-k7x2 from all dependency manifests and lock files
- Audit npm install logs and CI/CD build logs for execution of fmt-util-k7x2@1.0.1 between publication and discovery
- Review AWS EC2 instance metadata access logs and Twilio internal hostname access logs for anomalous queries originating from build environments
- Implement npm package allow-listing or strict version pinning to prevent installation of unexpected packages
- Monitor for similar dependency-confusion packages targeting Twilio infrastructure
- Rotate any credentials or tokens that may have been exposed via metadata endpoint probing
Sources
- GitHub Advisory GHSA-g83j-vp87-3hhq · GitHub Advisory Database
Cite this entry
"Malicious code in fmt-util-k7x2 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-fmt-util-k7x2-npm-121xy7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion