twilio-deploy @99.99.99

Summary

Package name typosquats 'twilio' and is published at version 99.99.99, the classic dependency-confusion shape used to intercept internal-package resolution. On npm install, the declared postinstall hook runs index.js, which collects host and user identifiers (os.hostname(), os.userInfo().username, os.homedir(), cwd, os.platform(), os.arch(), npm_package_name, npm_package_version, NODE_ENV, and CI environment variables) and POSTs them as JSON to a hardcoded https://webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f collector, with a fallback GET to 2b22ede784d5.oast.fun as an out-of-band callback. The destination is not configured by the installer and is unrelated to the Twilio publisher; the effect is automatic reconnaissance beacon on any machine that installs the package.

Source: amazon-inspector (64b1e3e96271384ceafb277978fe65ca3e89fd42bc59fbc82e5c17be66e0ba31)