MAL-2026-13920

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bb-twl-k7x2/MAL-2026-13920.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13920
Published
2026-08-12T15:40:45Z
Modified
2026-08-12T16:03:34.313903926Z
Summary
Malicious code in bb-twl-k7x2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8)

The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect installer-side reconnaissance: os.hostname(), the output of shell commands id, hostname -I, ip addr, ls /, ls -a $HOME, and getent hosts internal.twilio.com; environment values including HOME and the npm registry; presence and auth-flag checks for ~/.npmrc at multiple paths (HOME, /root, /usr/etc, /etc, parent paths) testing for _auth, _authToken, and password tokens; presence of ~/.aws and ~/.aws/credentials; and an AWS instance metadata service probe at http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve the IAM role name. The collected fields are transmitted via HTTP GET query string to http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d/. The package name and self-description as a bug-bounty canary do not change the observed behavior: credential-path reconnaissance and host enumeration on the installer's machine, sent over plain HTTP to a hardcoded third-party host, on any npm install of this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017616",
            "import_time": "2026-08-12T15:53:01.2399004Z",
            "sha256": "4c87c799fd2fe00ed4cfc7cb42b375a08e0fd38c5d2bc10179e5da21ccf07a47",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-12T15:40:52Z"
        },
        {
            "id": "IN-MAL-2026-017615",
            "import_time": "2026-08-12T15:53:01.13620003Z",
            "sha256": "7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-12T15:40:45Z"
        }
    ]
}
References
Credits

Affected packages

npm / bb-twl-k7x2

Package

Name
bb-twl-k7x2
View open source insights on deps.dev
Purl
pkg:npm/bb-twl-k7x2

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "canary.js",
            "tlsh": "a411639bc0fc603c22f1a5c1311646a3d9a3e2541305e4f0b4a8a0422fe657a6773aea",
            "sha256": "b865cf1f7dc75332ae09811e0c9dc3b0b82ba7c07a0c1dcc6db73444a4bda20f"
        },
        {
            "path": "package.json",
            "tlsh": "44d02b905801533b34c08beb1ca9c149a130de1f2048a83cdbe7158cc2977b7267bb5f",
            "sha256": "8d562b6f16fa75ce672276ff7fb3db3e715d1ddf37c73eba01334546dca3da8d"
        }
    ],
    "package_integrity": [
        {
            "filename": "bb-twl-k7x2-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-Zi/kWLcc8IC4HxlVED8vSLtraGo7LMQuPdx1zHKj9k4oOulIa/1LgJMoD+ICfrlEHR/BCOFiaesfAtHmWaaxfw==",
                "sha1": "ace621c334139aa6a8da1b782a69bda852f2ce26"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bb-twl-k7x2/MAL-2026-13920.json"