fmt-util-k7x2@1.0.0

Analysis

The postinstall hook (setup.js) of this package performs network reconnaissance and exfiltration. On install it probes internal Twilio infrastructure endpoints (www[.]stage[.]twilio[.]com, code[.]hq[.]twilio[.]com, twilio[.]jfrog[.]io, artifacts[.]twilio[.]com) and the AWS EC2 instance metadata service (hxxp://169[.]254[.]169[.]254/latest/meta-data/), then sends the reachability results to the attacker-controlled endpoint hxxp://bintool[.]brkd[.]no/compat-check. The AWS metadata probe indicates attempted harvesting of cloud instance credentials. The package's declared purpose (string formatting utilities) is unrelated to this behaviour.