According to an incident report published by Twilio today, the attackers injected the malicious code only within version 1.20 of the TaskRouter JS SDK library used by customers to route tasks to agents or processes via the Twilio TaskRouter attribute-based routing engine.