Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data.
The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731." In total, 11 versions of the package were published in quick succession on the same day over an approximately 45-minute time period. The npm user account no longer exists as of writing.
"The first version of tw-pkgprobe-7731 posed as an authorized security research probe," ReversingLabs researcher Lucija Valentić said in a report published today.
"Comments inside the package describe it as an 'Authorized bug-bounty research probe (Twilio HackerOne program)' that 'runs only inside Twilio's serverless packager sandbox' and 'collects local process/host context and writes it next to itself; no destructive action.'"
Upon execution, the package first checks if the current environment is a Twilio developer environment. It immediately exits if that's not the case.
Should the check pass, the malware proceeds to extract environment variables along with system details like mounts, temporary folders, and various configurations. The gathered information is then exfiltrated via a webhook.
Subsequent versions of the npm package (viz., versions 1.0.1, 1.0.2, and 1.0.3) have been found to focus on developers using Twilio APIs, specifically searching for folders tied to specific Twilio account String Identifiers (SIDs). Most importantly, it avoids taking any action if there exists a folder with a specific SID name.
"Otherwise, if matching target folders were found, it scanned installed npm packages and node_modules to inject a custom npm PoC package, creating package.json and index.js inside," ReversingLabs explained.
Version 1.0.4 is said to have introduced an added capability to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, effectively compromising the victim's Twilio credentials and potentially allowing the threat actor to authorize billing and trigger communication.
However, the final three versions (i.e., 1.0.8, 1.1.0, and 1.1.1) "reverted to the basic probing profile of the package seen in version 1.0.0," dropping the malicious functionality incorporated in prior iterations.
In addition, the last two versions have been found to conduct OSINT gathering by probing various Twilio-related hosts, such as support-api.us1.twilio[.]com, kafka-ui.au1.twilio[.]com and litellm.ai-services.corp.twilio[.]com, even fetching AWS metadata located at "169.254.169[.]254/latest/meta-data/."
Given these unusual course reversals, it's unclear what the end goals are and if it was published as part of a bug bounty program. However, ReversingLabs said the package versions did not follow Twilio's bug hunting guidelines listed on HackerOne.
"In other words, these packages clearly violate the basic security research guidelines Twilio established, which suggests that the packages had malicious intent," Valentić said. "While the threat actor behind the campaign attempted to mask malicious features in certain releases by surrounding them with seemingly benign features and code, they made no real effort to obscure the malicious code or hide their activity.
"There is no obfuscation, typosquatting, or attempt to make the publishing npm account look legitimate – tactics we’ve routinely seen in previous campaigns. This suggests that a less sophisticated threat actor is responsible for the malicious campaign targeting Twilio developers."
Update
Following the publication of the story, a Twilio spokesperson told The Hacker News that the offending npm packages have been removed from npm and that there is no evidence that its systems have been compromised.
"Twilio has not experienced a security incident, and our systems and customer data remain secure and uncompromised," the spokesperson said. "The npm packages have been removed. We strongly encourage organizations to stay diligent when downloading public software packages."
In an update posted on its Trust Center, Twilio is urging developers to follow the below best practices -
- Verify packages before installing them from public registries and install Twilio SDKs only from its official libraries page.
- Review install scripts.
- Use API keys scoped to the least access to limit what a compromised package could steal.
- Add dependency scanning and lockfiles to CI/CD pipelines to flag suspicious or unexpected dependency changes.
- Review third-party integrations before connecting them to Twilio accounts.
"Attackers increasingly publish packages, add-ons, and integrations that impersonate trusted vendors, including Twilio, to steal credentials and sensitive data from developer environments," Twilio noted.
"These tools may claim to be 'official' or 'authorized' security or research tools. Twilio will never ask you to install a package, script, or tool from outside our official documentation to verify or secure your account."
(The story was updated after publication on September 23, 2026, to include a response from Twilio.)
