Malicious npm Package Targets Twilio Developers and Attempts to Steal Credentials
Cybersecurity researchers have uncovered a malicious npm package named tw-pkgprobe-7731 that disguises itself as a security research tool for developers integrating Twilio into their applications while attempting to collect sensitive information from targeted environments.
The package was first uploaded to the npm registry in mid-August 2026 by an npm account named twdepprobe7731.
The account published 11 versions of the package within approximately 45 minutes on the same day. The npm account has since been removed.
According to security researchers at ReversingLabs, the first version of the package presented itself as an authorized security research probe associated with Twilio's HackerOne bug bounty program.
Comments included within the package described it as an "Authorized bug-bounty research probe" that was supposedly designed to operate inside Twilio's serverless packager sandbox.
Malware Checks for Twilio Environments
When executed, the package first determines whether it is running inside an environment associated with Twilio development.
If the environment does not meet the expected conditions, the package immediately terminates.
If the check succeeds, the package collects environment variables and system information, including mounted filesystems, temporary directories, and configuration details.
The collected information is then sent to an attacker-controlled webhook.
Later Versions Target Twilio Developers
Versions 1.0.1, 1.0.2, and 1.0.3 introduced additional functionality specifically targeting developers working with Twilio APIs.
These versions searched for directories associated with particular Twilio account String Identifiers, commonly known as SIDs.
The malware also contained logic designed to avoid taking action when a specific SID-related directory was present.
When matching target directories were discovered, the package searched installed npm packages and node_modules directories.
It could then inject a custom npm proof-of-concept package into the environment by creating files such as:
package.jsonindex.js
This behavior could potentially allow malicious code to be introduced into the targeted development environment.
Twilio Credentials Targeted
Version 1.0.4 introduced a more serious capability.
The package attempted to collect:
process.env.ACCOUNT_SIDprocess.env.AUTH_TOKEN
These environment variables can contain credentials associated with Twilio accounts.
If successfully obtained, such credentials could potentially allow an attacker to access Twilio resources, authorize billing-related actions, or abuse communication services.
Later Versions Removed Some Malicious Features
Interestingly, the final three versions, 1.0.8, 1.1.0, and 1.1.1, reverted much of the functionality back toward the basic probing behavior seen in version 1.0.0.
The malicious capabilities introduced in some of the intermediate versions were removed.
However, the final two versions added additional reconnaissance functionality.
The package probed several Twilio-related hosts, including:
support-api.us1.twilio[.]comkafka-ui.au1.twilio[.]comlitellm.ai-services.corp.twilio[.]com
The package also attempted to access AWS instance metadata through:
169.254.169[.]254/latest/meta-data/
Access to cloud instance metadata can expose information about the environment and, depending on configuration, potentially provide additional credentials or infrastructure details.
Researchers Question the Bug Bounty Explanation
The unusual changes between package versions make the attacker's ultimate objective unclear.
The package appeared to reference Twilio's bug bounty program, but ReversingLabs said the observed behavior did not comply with Twilio's published security research guidelines.
According to researcher Lucija Valentić, the package versions violated basic requirements established for security research conducted against Twilio systems.
ReversingLabs therefore assessed that the packages were likely created with malicious intent rather than being legitimate bug bounty tooling.
The researchers also noted that the campaign lacked several techniques commonly associated with more sophisticated npm supply chain attacks.
The package did not use significant code obfuscation, did not rely on obvious typosquatting, and did not make substantial efforts to make the publishing account appear legitimate.
This led ReversingLabs to assess that the campaign may have been conducted by a relatively less sophisticated threat actor targeting developers working with Twilio.
What Developers Should Do
Developers who installed tw-pkgprobe-7731 should treat the package as potentially malicious and investigate affected development environments.
Recommended steps include:
- Remove the malicious npm package.
- Review systems where the package was installed or executed.
- Rotate Twilio
ACCOUNT_SIDandAUTH_TOKENcredentials if they may have been exposed. - Review Twilio account activity for unauthorized usage or unexpected billing.
- Check npm project files and
node_modulesdirectories for unauthorized modifications. - Review outbound network connections for unexpected communication with external infrastructure.
- Inspect CI/CD and development environments for additional persistence or malicious packages.
The incident highlights the risks of downloading developer tools or security testing packages from public package repositories without independently verifying their origin and behavior.
Malicious npm packages can target developers directly because development environments often contain API credentials, cloud credentials, source code, internal service information, and access to production infrastructure.
