Rogue npm package targeted Twilio developer credentials
Security researchers at ReversingLabs have identified a malicious npm package, tw-pkgprobe-7731, that presented itself as an authorised security probe for Twilio developers but attempted to collect sensitive information. The package was uploaded in mid-August 2026 by the npm account twdepprobe7731, which has since been removed.
Its publisher released 11 versions in roughly 45 minutes on the same day. The first release used comments describing an “Authorized bug-bounty research probe (Twilio HackerOne program)” and claimed it would run only in Twilio’s serverless packager sandbox, collect local context and avoid destructive action.
Environment checks preceded data collection
The package first checked whether it was executing in a Twilio developer environment and exited if the test failed. When the check succeeded, it gathered environment variables along with information on mounts, temporary directories and configuration. That data was sent out through a webhook.
Versions 1.0.1, 1.0.2 and 1.0.3 shifted attention to projects using Twilio APIs. They searched for directories associated with particular Twilio account String Identifiers, or SIDs. If a folder with one specific SID name existed, the code took no action. Otherwise, when target directories were found, it scanned installed npm packages and node_modules, then created package.json and index.js files for a custom npm proof-of-concept package.
Credentials appeared in version 1.0.4
Version 1.0.4 added code to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN. Those values are Twilio credentials. ReversingLabs noted that their compromise could let an attacker authorise billing and trigger communications.
The final three releases, versions 1.0.8, 1.1.0 and 1.1.1, returned to the basic probing behaviour seen in version 1.0.0 and dropped the malicious capabilities added in intermediate versions. The last two versions also performed OSINT-style probing of Twilio-related hosts, including support-api.us1.twilio[.]com, kafka-ui.au1.twilio[.]com and litellm.ai-services.corp.twilio[.]com. They also requested AWS instance metadata from 169.254.169[.]254/latest/meta-data/.
Bug-bounty branding did not match the rules
The changing functionality leaves the operator’s ultimate aim unclear, including whether the activity was intended to resemble a bug-bounty submission. ReversingLabs concluded that the package versions did not follow Twilio’s published HackerOne bug-hunting guidelines. Researcher Lucija Valentić said the packages therefore violated the basic rules established for security research and indicated malicious intent.
The campaign did not use obfuscation, typosquatting or an npm account designed to look legitimate. ReversingLabs assessed this as a sign of a less sophisticated actor, rather than evidence that the code was harmless. For businesses, the practical response is to review dependency and lockfile history for this package, investigate any exposure, rotate potentially affected Twilio credentials, and require review before adding packages that claim to conduct security testing.