Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
A malicious npm package, disguised as a Twilio security probe, was uploaded to the npm registry. The package initially attempted to steal environment variables and system details from Twilio developer environments, and later progressed to exfiltrating Twilio credentials and conducting OSINT gathering. The threat actor’s attempts to mask malicious behavior were rudimentary, suggesting a less experienced attacker.
A malicious npm package named "tw-pkgprobe-7731" was uploaded to the npm registry, masquerading as a security probe targeting developers integrating Twilio into their applications. Cybersecurity researchers at ReversingLabs discovered the package was first uploaded in mid-August 2026 by an npm account named "twdepprobe7731." In total, 11 versions of the package were published over a 45-minute period. The npm user account no longer exists.
Initially, the package checked if the current environment was a Twilio developer environment and exited if it wasn't. If it was, the malware extracted environment variables and system details, including mounts, temporary folders, and configurations. The gathered information was then exfiltrated via a webhook.
Subsequent versions (1.0.1, 1.0.2, and 1.0.3) focused on developers using Twilio APIs, specifically searching for folders tied to specific Twilio Account String Identifiers (SIDs). The package avoided taking any action if a matching folder with a specific SID name existed. If a matching folder *was* found, it scanned installed npm packages and node_modules to inject a custom npm PoC package, creating `package.json` and `index.js` inside.
Version 1.0.4 introduced the capability to exfiltrate `process.env.ACCOUNT_SID` and `process.env.AUTH_TOKEN`, effectively compromising the victim’s Twilio credentials and potentially allowing the threat actor to authorize billing and trigger communication.
However, the last two versions (1.0.8, 1.1.0, and 1.1.1) reverted to the basic probing profile of the package seen in version 1.0.0, dropping the malicious functionality incorporated in prior iterations. These later versions also conducted OSINT gathering by probing various Twilio-related hosts, such as `support-api.us1.twilio[.]com`, `kafka-ui.au1.twilio[.]com` and `litellm.ai-services.corp.twilio[.]com`, even fetching AWS metadata located at "169.254.169[.]254/latest/meta-data/."
Given these unusual course reversals, it’s unclear what the end goals are and if it was published as part of a bug bounty program. However, ReversingLabs said the package versions did not follow Twilio’s bug hunting guidelines listed on HackerOne, suggesting the packages had malicious intent. The threat actor’s attempts to mask malicious features were rudimentary, lacking obfuscation, typosquatting, or any effort to hide their activity, indicating a less sophisticated attacker.