MAL-2026-6373

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twilio-voice-js-reference-components/MAL-2026-6373.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6373
Published
2026-06-24T03:36:02Z
Modified
2026-06-24T05:01:22.140244799Z
Summary
Malicious code in twilio-voice-js-reference-components (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a3a57b06daad43c269fe3846083da2fdce277fd1ff3a9399533072f6e894afc2)

Package impersonates the Twilio Voice JS SDK namespace and ships a single exfiltration payload. package.json declares "preinstall": "node index.js", causing index.js to run automatically on npm install with no user interaction. index.js requires os/fs/https, collects os.hostname(), os.userInfo(), the user's home directory, DNS server configuration, and reads /etc/passwd and /etc/hosts, then POSTs the collected data over HTTPS to kocxl3uxcqn73ybo0k9e4g6d74d41upj.oastify.com — a Burp Collaborator out-of-band probe subdomain controlled by the attacker. The package contains no real reference components, has empty author/description metadata, and the name closely mimics the legitimate Twilio Voice JS package — a typosquat / dependency-confusion lure aimed at Twilio-related build systems.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-24T04:54:33.581892771Z",
            "source": "amazon-inspector",
            "sha256": "a3a57b06daad43c269fe3846083da2fdce277fd1ff3a9399533072f6e894afc2",
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-007411",
            "modified_time": "2026-06-24T03:36:02Z"
        }
    ]
}
References
Credits

Affected packages

npm / twilio-voice-js-reference-components

Package

Name
twilio-voice-js-reference-components
View open source insights on deps.dev
Purl
pkg:npm/twilio-voice-js-reference-components

Affected ranges

Affected versions

1.*
1.0.1

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "3741139592d917330dd110c06b0c74842359fa77726999d076cf42969f869f8b7216f3",
            "sha256": "f7bf3239a4ff432f89ed968864243f4d06a21b677d72e561b0479b350ca80dd0",
            "path": "index.js"
        },
        {
            "tlsh": "0cd05b344e12552325c50651083b954b72618e6f04143c04578b542c41ce77758fb35e",
            "sha256": "700bc3657d0ce6c8c2f0e4b452d7ef9dc243e0d20ec7fe4c06e776e1a53c8bc2",
            "path": "package.json"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/twilio-voice-js-reference-components/MAL-2026-6373.json"