Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
- Disclosed
- Last updated
- Blast radius
- AWS Lambda environments and any system installing the malicious package; cross-tenant compromise potential in shared container/serverless environments
- Ecosystems
- Attack vectors
- Affected entities
- twilio-hackerone-poc-afe6937cnpm package containing malicious preinstall/postinstall scripts
The npm package twilio-hackerone-poc-afe6937c was published with embedded malicious code in its install scripts. Upon installation, the package executes reconnaissance commands (id, environment variable enumeration, /var/task listing, /proc inspection) and exfiltrates collected metadata as JSON to a hardcoded webhook.site endpoint (https://webhook.site/b520829e-516a-45ff-980c-173aa54fc4bc).
The malicious behavior includes a persistence mechanism: probe.js copies daemon.js to /tmp/.h1poc-daemon.js and spawns it as a detached background process that survives the npm install completion. The daemon polls /tmp every 100ms for sibling tenant directories and enumerates service and package paths, sending heartbeat and startup events back to the same external webhook for approximately 15 minutes.
Most critically, for tenant IDs in a hardcoded list, the daemon writes package.json and index.js files into other tenants' node_modules/h1-poc-marker/ directories, injecting a require-able module into other accounts' dependency trees. This enables cross-tenant code execution in shared container or serverless environments.
The package name and stated purpose reference a HackerOne proof-of-concept, but the actual mechanisms—install-time exfiltration, persistent background processes, and cross-tenant writes—constitute a genuine supply chain attack with severe implications for AWS Lambda and other multi-tenant deployments.
Indicators of compromise
- Packages
- twilio-hackerone-poc-afe6937c
- Domains
- webhook.site
Remediation
- Immediately uninstall twilio-hackerone-poc-afe6937c from all systems
- Audit npm install logs and environment variable exposure for the affected timeframe
- Rotate AWS credentials and review CloudTrail logs for unauthorized activity
- Scan /tmp for leftover daemon processes (.h1poc-daemon.js, .h1poc.pid, .h1poc.ver) and remove them
- Review node_modules/h1-poc-marker/ in all projects for injected code
- Implement npm package allowlisting and pre-install script auditing
- Monitor webhook.site endpoint logs if accessible to determine what metadata was exfiltrated
Sources
- GitHub Advisory GHSA-967c-3f68-4gxj · GitHub Advisory Database
Cite this entry
"Malicious code in twilio-hackerone-poc-afe6937c (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-twilio-hackerone-poc-afe6937c-npm-1plh9z
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit