twilio-voice-js-reference-components@1.0.1

Analysis

This package impersonates Twilio's voice reference components (combosquat: "twilio-voice-js-reference-components"). On installation, the preinstall hook runs index.js which collects the following from the installer's system: hostname, home directory, username, DNS server configuration, the contents of /etc/passwd and /etc/hosts, the install directory path, and the full package.json. All collected data is exfiltrated via HTTPS POST to kocxl3uxcqn73ybo0k9e4g6d74d41upj[.]oastify[.]com (port 443). The exfiltration runs automatically on npm install with no user interaction required. The package has no legitimate functionality beyond stealing system information.