Malicious npm Package Targets Twilio Developers via Fake Probe
A malicious npm package called tw-pkgprobe-7731 has been found posing as a security tool for developers who integrate Twilio into their applications, while quietly trying to collect sensitive data from their machines. The package was published to the npm registry, the central online warehouse for JavaScript code packages, by an account named twdepprobe7731 in mid-August 2026. ReversingLabs researcher Lucija Valentić described the findings in a report, noting that 11 versions were released within about 45 minutes on the same day, and the account that published them no longer exists as of the time of the report.
The first version tried to look like an authorized security research probe. Comments inside the package described it as an authorized bug-bounty research probe for the Twilio HackerOne program, claiming it runs only inside Twilio's serverless packager sandbox and collects local process and host context, writing it next to itself with no destructive action. When executed, the package first checks whether it is running inside a Twilio developer environment. If that check fails, it exits immediately. If the check passes, it collects environment variables, which are small pieces of information programs use such as account details, together with system details like mounted storage, temporary folders, and various configuration settings. Everything it collects is then sent to an outside destination through a webhook, meaning the program sends the data automatically to a URL controlled by the attacker.
Later versions, numbered 1.0.1, 1.0.2, and 1.0.3, changed focus to developers using Twilio APIs. These versions searched for folders connected to specific Twilio account SIDs, the string identifiers that label each Twilio account. The code would avoid taking any action if it found a folder with a specific SID name. If matching target folders were found, the package scanned installed npm packages and the node_modules folder, where JavaScript projects keep their dependencies, and injected a custom proof-of-concept package by creating new package.json and index.js files inside it. In other words, it tried to plant additional code into a developer's project when the right conditions were met.
Version 1.0.4 went further. ReversingLabs found that this release added the ability to steal two particular environment variables: process.env.ACCOUNT_SID and process.env.AUTH_TOKEN. These are the values that identify a Twilio account and prove that a request is authorized. If an attacker obtains both, they can potentially control the victim's Twilio account closely enough to authorize billing and trigger communications. The report explains that the package versions did not follow Twilio's published bug hunting guidelines on HackerOne, and the researcher said these packages clearly violate the basic security research guidelines Twilio established, which suggests the packages had malicious intent.
The final three versions, numbered 1.0.8, 1.1.0, and 1.1.1, took an unexpected step back. They reverted to the basic probing behavior seen in the very first version and dropped the malicious functions added in earlier releases. The last two versions also performed open-source intelligence gathering, or OSINT, by reaching out to several Twilio-related hostnames: support-api.us1.twilio[.]com, kafka-ui.au1.twilio[.]com, and litellm.ai-services.corp.twilio[.]com. They even tried to fetch Amazon Web Services metadata from the special address 169.254.169[.]254/latest/meta-data/, which can expose information about the cloud server. Because the package changed direction so often, the researchers say it is unclear what the final goal really was and whether it was published as part of a bug bounty program.
Despite the attempt to blend harmful and harmless code, the author made no real effort to hide the malicious parts. There was no obfuscation, meaning the code was not scrambled to make it hard to understand, and no typosquatting, meaning the creator did not use a name very similar to a trusted package to trick developers. The publishing npm account also made no attempt to look like a legitimate publisher. ReversingLabs noted this is different from previous campaigns and suggests a less sophisticated threat actor was responsible for the effort targeting Twilio developers. For anyone who builds or runs software that depends on npm packages, this case is a reminder that a plausible description and a professional-looking comment inside code are not enough to establish trust.
Site owners and IT teams should treat package selection as a security decision, not just a convenience. Checking the publisher account, its age, and its release history before installing can catch fake probes before they run. Readers who manage their own websites can also reduce some of this risk by choosing a hosting provider such as AEU Hosting that handles security updates and monitoring for managed WordPress environments, so a malicious dependency has less room to spread.