{"answers":{"affected":"1 open source package ship an affected version, including bb-twl-k7x2.","exploited":"There is no known exploitation of MAL-2026-13920 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13920 is a malicious package in bb-twl-k7x2, published on 12 Aug 2026."},"fix_prompt":"MAL-2026-13920 is a malicious package: bb-twl-k7x2 (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13920/ (Markdown: https://insights.sbomify.com/MAL-2026-13920/index.md)","id":"MAL-2026-13920","markdown":"https://insights.sbomify.com/MAL-2026-13920/index.md","name":"MAL-2026-13920","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package's install and postinstall lifecycle scripts (canary.js) run unconditionally on npm install and collect installer-side reconnaissance: os.hostname(), the output of shell commands id, hostname -I, ip addr, ls /, ls -a $HOME, and getent hosts internal.twilio.com; environment values including HOME and the npm registry; presence and auth-flag checks for ~/.npmrc at multiple paths (HOME, /root, /usr/etc, /etc, parent paths) testing for _auth, _authToken, and password tokens; presence of ~/.aws and ~/.aws/credentials; and an AWS instance metadata service probe at http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve the IAM role name. The collected fields are transmitted via HTTP GET query string to http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d/. The package name and self-description as a bug-bounty canary do not change the observed behavior: credential-path reconnaissance and host enumeration on the installer's machine, sent over plain HTTP to a hardcoded third-party host, on any npm install of this package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in bb-twl-k7x2 (npm)","id":"MAL-2026-13920","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"bb-twl-k7x2","purl":"pkg:npm/bb-twl-k7x2","source":"MAL-2026-13920"}],"products":null,"published":"2026-08-12","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13920/"}