twilio-deploynpm
twilio-deploy is a confirmed malicious npm package (MAL-2026-10933) that steals credentials and exfiltrates sensitive data (malicious versions 99.99.99, 99.99.100). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in twilio-deploy (npm)
What this malware does
The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' (maintainer email [email protected]), all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a private registry. The npm description is empty and the package provides no legitimate functionality; the name mimics a plausible internal Twilio package so that a misconfigured resolver installs this public lookalike instead of the intended private dependency.
The package declares a postinstall hook ("node index.js") that executes automatically on a bare npm install with no consent gate. The bundled index.js payload (1,185 bytes, sha256 prefix c324d579006df4c5, identical across all four packages) performs environment reconnaissance: it collects the npm package name and version, os.hostname(), the OS username (os.userInfo().username), the home directory path (os.homedir()), the current working directory, os.platform(), os.arch(), NODE_ENV, and the CI flag. It serializes this to JSON and exfiltrates it via HTTPS POST to a hardcoded anonymous dead-drop at https://webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f (the same collector UUID across all four packages). On request error the payload falls back to a redundant out-of-band callback to 2b22ede784d5.oast.fun over HTTP, ensuring the beacon lands even where HTTPS egress to webhook.site is blocked; errors on that path are swallowed.
The collected cwd/homedir/username/CI/NODE_ENV set is reconnaissance targeting internal build environments and their filesystem layout. All four packages (twilio-serverless, twilio-assets, twilio-deploy, twilio-internal) were published by the same maintainer with an identical payload and the same collector endpoint.
Package name typosquats 'twilio' and is published at version 99.99.99, the classic dependency-confusion shape used to intercept internal-package resolution. On npm install, the declared postinstall hook runs index.js, which collects host and user identifiers (os.hostname(), os.userInfo().username, os.homedir(), cwd, os.platform(), os.arch(), npm_package_name, npm_package_version, NODE_ENV, and CI environment variables) and POSTs them as JSON to a hardcoded https://webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f collector, with a fallback GET to 2b22ede784d5.oast.fun as an out-of-band callback. The destination is not configured by the installer and is unrelated to the Twilio publisher; the effect is automatic reconnaissance beacon on any machine that installs the package.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for twilio-deploy (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging twilio-deploy across your stack and pipelines.
If you installed it — respond
twilio-deploy is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If twilio-deploy was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks twilio-deploy before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- SafeDep · finder
Detect & block this
O3 blocks twilio-deploy-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.