twilio-hackerone-poc-afe6937c@1.0.0

Analysis

The package runs probe.js on install (preinstall and postinstall). Inside a Twilio build-packager container (working directory matching /tmp/AC<32-hex>/), it collects host metadata — the current user id, working directory, parent process command line, AWS Lambda log stream name, and a listing of /var/task — and POSTs it as JSON to webhook[.]site/b520829e-516a-45ff-980c-173aa54fc4bc. It then spawns a detached daemon (copied to /tmp/.h1poc-daemon.js) that every 100ms scans /tmp for Twilio account build directories, reports each discovered account/service/package to the same webhook, and injects a marker package named h1-poc-marker into the node_modules of build directories belonging to a hardcoded account. The daemon sends heartbeats to the webhook every 30 seconds and exits after 15 minutes.