{"answers":{"affected":"1 open source package ship an affected version, including org-twilio-phone-numbers-utils.","exploited":"There is no known exploitation of MAL-2026-10931 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10931 is a malicious package in org-twilio-phone-numbers-utils, published on 20 Jul 2026."},"fix_prompt":"MAL-2026-10931 is a malicious package: org-twilio-phone-numbers-utils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10931/ (Markdown: https://insights.sbomify.com/MAL-2026-10931/index.md)","id":"MAL-2026-10931","markdown":"https://insights.sbomify.com/MAL-2026-10931/index.md","name":"MAL-2026-10931","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' (maintainer email charankumarj2004@gmail.com) at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a private registry. The npm description is empty and the package provides no legitimate functionality; the name mimics a plausible internal Twilio package so that a misconfigured resolver installs this public lookalike instead of the intended private dependency. It belongs to the same campaign as the actor's twilio-serverless/twilio-assets/twilio-deploy/twilio-internal squats and beacons to the same webhook.site collector.\n\nThe package declares a postinstall hook (\"node index.js\") that executes automatically on a bare npm install with no consent gate. The index.js payload performs environment reconnaissance: it collects the npm package name (npm_package_name), os.hostname(), the OS username (os.userInfo().username), and the current working directory, serializes them to JSON, and exfiltrates the bundle via HTTPS POST to a hardcoded anonymous dead-drop at https://webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f. Request errors are swallowed so the install appears to succeed.\n\nTwo iterations were published: version 99.99.99 (payload 494 bytes, sha256 prefix 0ec56ada88db35b6) beacons only to the webhook.site collector, while version 99.99.100 (payload 688 bytes, sha256 prefix cebf45a0feba28b3) additionally beacons to a redundant out-of-band callback at 8060h91v8p1bvvr24e3r8s3z4qahy7mw.oastify.com, ensuring the reconnaissance lands even where HTTPS egress to webhook.site is blocked. Both payloads are byte-identical across all four packages in this sub-cluster (twiliointernal-messaging-toolbox, org-twilio-phone-numbers-utils, twilio-platform-request, twilio-platform-async-data-fetch).\n\norg-twilio-phone-numbers-utils@99.99.100 is a dependency-confusion beacon package. Its package.json registers a postinstall hook that runs index.js, which collects the installer's package name, hostname (os.hostname()), username (os.userInfo()), and current working directory, then POSTs them via https to two hardcoded external destinations: webhook.site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f and 8060h91v8p1bvvr24e3r8s3z4qahy7mw.oastify.com (a Burp Collaborator subdomain used for out-of-band reconnaissance). The name mimics an internal org-scoped Twilio helper and the inflated 99.99.100 version is chosen to win registry resolution against a private package of the same name. Execution is automatic on npm install; the installer has no opt-in and the collected identifiers reveal internal host and user names to the attacker.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in org-twilio-phone-numbers-utils (npm)","id":"MAL-2026-10931","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"org-twilio-phone-numbers-utils","purl":"pkg:npm/org-twilio-phone-numbers-utils","source":"MAL-2026-10931"}],"products":null,"published":"2026-07-20","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10931/"}