Cybersecurity researchers have uncovered a malicious npm package that pretended to be an authorized Twilio security-testing tool but contained functionality capable of collecting sensitive system information and stealing Twilio credentials.
The package, tw-pkgprobe-7731, was identified by security researchers at ReversingLabs, who said it targeted developers working with Twilio APIs and changed its behavior across multiple releases.
Fake Bug-Bounty Tool Published on npm
The malicious package first appeared on the npm registry in August 2026 under the account twdepprobe7731.
Researchers identified 11 versions released within roughly 45 minutes. The npm account used to publish the package has since disappeared.
The initial release presented itself as an authorized security research probe associated with Twilio’s HackerOne bug-bounty program. Comments embedded in the code claimed that the tool was designed to operate inside Twilio’s serverless environment and collect information for security research.
However, the package contained functionality that went beyond those stated purposes.
Malware Checked for Twilio Environments
When executed, the package first attempted to determine whether it was running in a Twilio-related development environment.
If the expected environment was not detected, the program stopped. If the check succeeded, it collected information such as environment variables, mounted locations, temporary directories and other system configuration details.
The collected information was then transmitted to an external webhook.
Researchers said later versions became more specifically focused on developers using Twilio APIs.
Package Could Target Twilio Developer Projects
Versions 1.0.1, 1.0.2 and 1.0.3 introduced additional checks designed to identify directories associated with Twilio account identifiers.
When certain conditions were met, the package searched installed npm dependencies and node_modules directories. Researchers found that it could then create files including package.json and index.js as part of a custom proof-of-concept package.
This behavior raised concerns that the package could be used to manipulate software-development environments and potentially compromise projects containing sensitive credentials.
Later Version Added Credential Theft
One of the most significant changes appeared in version 1.0.4, which added functionality designed to collect the environment variables:
These values can be associated with Twilio account authentication and could potentially give an attacker access to sensitive account capabilities.
Researchers warned that stolen credentials could potentially be abused for unauthorized account activity, including actions that could generate charges or send communications through a compromised Twilio account.
Later Releases Removed Some Malicious Features
Interestingly, the package’s final versions changed direction again.
Versions 1.0.8, 1.1.0 and 1.1.1 reportedly removed the credential-stealing functionality and largely returned to the basic probing behavior seen in the original release.
The final two versions nevertheless introduced additional reconnaissance capabilities.
Researchers observed the package probing several Twilio-related hosts and attempting to retrieve information from the AWS instance metadata service. This suggests that the campaign may have been intended to gather information about Twilio’s internal infrastructure or development environments.
Security Researchers Question Bug-Bounty Claims
ReversingLabs said it remains unclear what the attackers ultimately intended to achieve or whether the package was genuinely connected to a Twilio bug-bounty investigation.
However, researchers found that the package’s behavior did not comply with Twilio’s publicly documented security research requirements on HackerOne.
The researchers therefore concluded that the package was more consistent with a malicious campaign than legitimate vulnerability research.
Unlike some sophisticated supply-chain attacks, the campaign did not rely heavily on obfuscation, typosquatting or an elaborate attempt to make the npm publisher account appear authentic.
Developers Urged to Scrutinize npm Dependencies
The incident highlights the risks developers face when installing third-party packages from public software repositories.
Malicious packages can imitate legitimate development utilities, security-testing tools or vendor-specific projects while quietly collecting credentials and system information.
Developers using npm should carefully verify package publishers, review dependencies and inspect unusual installation or execution behavior before adding unfamiliar packages to production or development environments.
Organizations should also monitor exposed credentials and rotate authentication tokens if a potentially malicious package has been installed in an environment containing sensitive Twilio credentials.
