Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Malicious npm package tw-pkgprobe-7731 posed as a Twilio bug-bounty probe and can steal credentials.
ReversingLabs disclosed the malicious npm package tw-pkgprobe-7731, uploaded in mid-August 2026 by the account twdepprobe7731. Eleven versions appeared within about 45 minutes and were described in comments as an authorized Twilio HackerOne bug-bounty probe. After detecting a Twilio developer environment, the code collected environment variables, mounts, and configuration and sent them to a webhook. Versions 1.0.1 through 1.0.4 searched for Twilio account SID folders, injected a custom npm package, and exfiltrated ACCOUNT_SID and AUTH_TOKEN, while later builds probed Twilio hosts and the AWS instance metadata service.
- Package tw-pkgprobe-7731 was uploaded to npm in mid-August 2026 by twdepprobe7731.
- Eleven versions were published in about 45 minutes; the account was later removed.
- It claimed to be an authorized Twilio HackerOne bug-bounty research probe.
- Some versions exfiltrated ACCOUNT_SID and AUTH_TOKEN and injected a custom npm package.
- ReversingLabs says the packages violate Twilio's published bug-hunting guidelines.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1036 MasqueradingT1528 Steal Application Access TokenT1552.005 Cloud Instance Metadata APIT1041 Exfiltration Over C2 Channel
- Malware
- tw-pkgprobe-7731
- Organizations
- ReversingLabsTwilio
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | twilio.com | obing various Twilio-related hosts, such as support-api.us1.twilio[.]com, kafka-ui.au1.twilio[.]com and litellm.ai-services.corp.t |
From the original article
2 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731."
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.