Fake Twilio Probe Package Steals Developer Credentials
A malicious npm package disguised as a security tool harvested sensitive data from developers integrating Twilio, bypassing standard safety checks.
Key points
- Malicious npm package tw-pkgprobe-7731 posed as a Twilio bug-bounty probe to harvest developer credentials.
- Eleven versions were published in 45 minutes, with later iterations specifically targeting Twilio account identifiers and tokens.
- The package violated bug bounty guidelines and lacked obfuscation, suggesting a less sophisticated threat actor.
Cybersecurity researchers have identified a malicious npm package designed to trick developers into installing code that harvests sensitive information. The package, named tw-pkgprobe-7731, was uploaded to the npm registry in mid-August 2026 and posed as an authorized bug-bounty probe for Twilio, a popular communication platform. According to reports from The Hacker News, the package aimed to extract environment variables and system details from machines running specific developer tools.
The threat actor published eleven versions of the package within a 45-minute window before deleting the associated npm account. While the initial versions collected general system context, later iterations specifically targeted Twilio credentials, including account identifiers and authentication tokens. This data theft could allow attackers to authorize billing or trigger communications on behalf of the victim.
Package mimics legitimate security tools
The package included comments claiming it was an authorized research probe running inside Twilio's serverless sandbox. It stated that it collected local process context without performing destructive actions. However, upon execution, the code first checked if the environment matched Twilio's developer setup. If the check passed, it proceeded to extract sensitive data and send it to an external webhook, effectively exfiltrating the information.
Later versions of the package scanned installed dependencies and node modules to inject a custom proof-of-concept package. This allowed the malicious code to persist and continue harvesting data. The final versions reverted to basic probing behavior but also included attempts to gather open-source intelligence by accessing internal Twilio hosts and AWS metadata endpoints.
Violation of bug bounty guidelines
Researchers noted that the package did not follow Twilio's established bug hunting guidelines listed on HackerOne. The code lacked common obfuscation techniques or typosquatting, suggesting a less sophisticated threat actor. Instead of hiding its malicious intent, the package relied on social engineering to trick developers into trusting it as a legitimate security tool.
The rapid publication of multiple versions and the subsequent deletion of the npm account indicate an attempt to cover tracks. However, the lack of advanced hiding tactics makes the package easier to identify and block. Developers are advised to audit their dependencies and remove any packages with names resembling this specific probe.
Risk to developer credentials remains
The primary risk lies in the compromise of Twilio credentials, which can be used for unauthorized billing or communication. The package's ability to inject code into node modules means that even if the main package is removed, residual malicious code may persist. Organizations should monitor their npm dependencies closely and ensure that only trusted packages are installed in their development environments.
This incident highlights the ongoing threat of supply chain attacks targeting popular development platforms. While the specific package has been identified, similar tactics could be used to target other developers. Staying informed about known vulnerabilities and maintaining strict dependency management are essential steps to mitigate these risks.
