GCVE-110-OSM-2026-10501

On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path (/tmp/AC<32hex>/) and, if so, copies daemon.js to /tmp/.npm-helper.js and spawns it as a detached background process via process.execPath. The daemon polls /tmp every 80ms for sibling directories whose names match Twilio account SIDs (AC followed by 32 hex chars) and POSTs the discovered account/service/package identifiers to a hardcoded https://webhook.site/cc08d9d9-232a-42a2-8d55-0f75cb5e0e67 endpoint. For matching directories it captures process.env.ACCOUNT_SID and a prefix of process.env.AUTH_TOKEN and writes them to a proof file. The daemon also writes an 'injected-by-other-tenant' module into sibling build trees and appends a payload (marked /*XTENANT_PROOF*/) into runtime-handler's main file so that a different tenant's execution context runs attacker-authored code that captures that tenant's ACCOUNT_SID and AUTH_TOKEN prefix. package.json description and code comments frame the package as an authorized Twilio HackerOne bug-bounty probe; that self-labeling does not change the mechanical behavior, which is an install-time dropper, cross-tenant code injection, and remote exfiltration to a third-party webhook endpoint.