MAL-2026-13920 Malicious code in bb-twl-k7x2 (npm)

The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect installer-side reconnaissance: os.hostname(), the output of shell commands id, hostname -I, ip addr, ls /, ls -a $HOME, and getent hosts internal.twilio.com; environment values including HOME and the npm registry; presence and auth-flag checks for ~/.npmrc at multiple paths (HOME, /root, /usr/etc, /etc, parent paths) testing for _auth, _authToken, and password tokens; presence of ~/.aws and ~/.aws/credentials; and an AWS instance metadata service probe at http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve the IAM role name. The collected fields are transmitted via HTTP GET query string to http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d/. The package name and self-description as a bug-bounty canary do not change the observed behavior: credential-path reconnaissance and host enumeration on the installer's machine, sent over plain HTTP to a hardcoded third-party host, on any npm install of this package.