Cybersecurity researchers have disclosed details of a malicious npm package named “tw-pkgprobe-7731” that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data.
The package, named “tw-pkgprobe-7731,” was first uploaded to the npm registry in mid-August 2026 by an npm account named “twdepprobe7731.” In total, 11 versions of the package were published in quick succession on the same day over an approximately 45-minute time period. The npm user account no longer exists as of writing.
“The first version of tw-pkgprobe-7731 posed as an authorized security research probe,” ReversingLabs researcher Lucija Valentić said in a report published today.
“Comments inside the package describe it as an ‘Authorized bug-bounty research probe (Twilio HackerOne program)’ that ‘runs only inside Twilio’s serverless packager sandbox’ and ‘collects local process/host context and writes it next to itself; no destructive action.'”
Upon execution, the package first checks if the current environment is a Twilio developer environment. It immediately exits if that’s not the case.
Should the check pass, the malware proceeds to extract environment variables along with system details like mounts, temporary folders, and various configurations. The gathered information is then exfiltrated via a webhook.
Subsequent versions of the npm package (viz., versions 1.0.1, 1.0.2, and 1.0.3) have been found to focus on developers using Twilio APIs, specifically searching for folders tied to specific Twilio account String Identifiers (SIDs). Most importantly, it avoids taking any action if there exists a folder with a specific SID name.
“Otherwise, if matching target folders were found, it scanned installed npm packages and node_modules to inject a custom npm PoC package, creating package.json and index.js inside,” ReversingLabs explained.
Version 1.0.4 is said to have introduced an added capability to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, effectively compromising the victim’s Twilio credentials and potentially allowing the threat actor to authorize billing and trigger communication.
However, the final three versions (i.e., 1.0.8, 1.1.0, and 1.1.1) “reverted to the basic probing profile of the package seen in version 1.0.0,” dropping the malicious functionality incorporated in prior iterations.
In addition, the last two versions have been found to conduct OSINT gathering by probing various Twilio-related hosts, such as support-api.us1.twilio[.]com, kafka-ui.au1.twilio[.]com and litellm.ai-services.corp.twilio[.]com, even fetching AWS metadata located at “169.254.169[.]254/latest/meta-data/.”
Given these unusual course reversals, it’s unclear what the end goals are and if it was published as part of a bug bounty program. However, ReversingLabs said the package versions did not follow Twilio’s bug hunting guidelines listed on HackerOne.
“In other words, these packages clearly violate the basic security research guidelines Twilio established, which suggests that the packages had malicious intent,” Valentić said. “While the threat actor behind the campaign attempted to mask malicious features in certain releases by surrounding them with seemingly benign features and code, they made no real effort to obscure the malicious code or hide their activity.
“There is no obfuscation, typosquatting, or attempt to make the publishing npm account look legitimate – tactics we’ve routinely seen in previous campaigns. This suggests that a less sophisticated threat actor is responsible for the malicious campaign targeting Twilio developers.”
