twilio-functions@99.99.99

Analysis

Five combosquat packages (twilio-functions, twilio-assets, twilio-deploy, twilio-internal, twilio-serverless) all at version 99.99.99 contain an identical postinstall hook that exfiltrates system metadata. On install, index.js collects hostname, username, home directory, current working directory, platform, architecture, NODE_ENV, and CI environment variables, then POSTs the data to webhook[.]site/42ce0f0e-a0a0-41b5-b157-1c0f918e064f. If that HTTPS request fails, it falls back to a DNS callback via HTTP GET to 2b22ede784d5[.]oast[.]fun. The packages have no repository, no description, and no legitimate functionality — they are reconnaissance implants targeting developers who may confuse them with official Twilio packages.