"The first version of tw-pkgprobe-7731 posed as an authorized security research probe," ReversingLabs researcher Lucija Valentić said in a report published today.
Behavior of tw-pkgprobe-7731: targeted probing, conditional execution
The package, published to the npm registry in mid‑August 2026 by an npm account named "twdepprobe7731," contained logic to detect whether it was running inside a Twilio developer environment and to bail out immediately if that check failed. When the check passed, the package collected environment variables and system details — including mounts, temporary folders, and various configuration files — then exfiltrated that data via a webhook, according to ReversingLabs.
Eleven versions of the package were pushed in rapid succession on the same day, spanning an approximately 45‑minute window. The npm publisher account no longer exists as of writing.
How later versions hunted for Twilio SIDs and attempted local injection
ReversingLabs found that versions 1.0.1, 1.0.2 and 1.0.3 shifted focus toward developers using Twilio APIs. These releases searched for folders tied to specific Twilio account String Identifiers (SIDs). If a folder with a particular SID name existed, the package refrained from further action. If matching target folders were found, however, the code scanned installed npm packages and node_modules directories and attempted to inject a custom proof‑of‑concept npm package by creating package.json and index.js files inside victim modules.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageVersion 1.0.4 introduced credential exfiltration
Most notably, version 1.0.4 added the ability to read and exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN. ReversingLabs warns that this behavior "effectively" compromises a victim's Twilio credentials and could allow a threat actor to authorize billing and trigger communications using those credentials.
Later reversion, OSINT probes and AWS metadata access
The campaign did not follow a strictly escalating trajectory. The final three recorded releases — 1.0.8, 1.1.0 and 1.1.1 — reverted to the more basic probing profile seen in version 1.0.0 and dropped the credential‑theft functionality introduced earlier. ReversingLabs also observed that the last two versions conducted open‑source intelligence (OSINT) style reconnaissance by probing multiple Twilio‑related hosts, including support‑api.us1.twilio[.]com, kafka‑ui.au1.twilio[.]com and litellm.ai‑services.corp.twilio[.]com, and by fetching AWS instance metadata from 169.254.169[.]254/latest/meta-data/.
ReversingLabs' assessment and Twilio HackerOne guidance
ReversingLabs concluded the packages violated Twilio's bug hunting guidelines listed on HackerOne and said that the releases "clearly violate the basic security research guidelines Twilio established, which suggests that the packages had malicious intent," Valentić wrote. The researcher also noted an absence of typical concealment tactics: "There is no obfuscation, typosquatting, or attempt to make the publishing npm account look legitimate – tactics we’ve routinely seen in previous campaigns. This suggests that a less sophisticated threat actor is responsible for the malicious campaign targeting Twilio developers."
What this means for Twilio developers and security teams
- Twilio developers and DevOps teams: The package demonstrates a supply‑chain strategy that conditionally enables dangerous behavior only in recognized developer environments and, in one release, directly targeted environment variables used for authentication. Teams should verify dependencies and audit any newly added npm packages that claim to be security tooling for Twilio integration.
- Security teams and incident responders: The injection behavior — creating package.json and index.js inside node_modules — plus webhook exfiltration and AWS metadata access indicate a need to monitor for unexpected local file changes, anomalous outbound connections to unknown webhooks, and unusual reads of instance metadata endpoints.
The package's rapid version churn, the mid‑August 2026 publication date, the temporary appearance of credential theft in version 1.0.4, and the subsequent reversion to basic probing leave an open question about intent: was this a clumsy attempt to masquerade as authorized research, an experiment by a low‑sophistication actor, or a staged probe with goals not yet evident? ReversingLabs' report, and the fact that the npm account has since been removed, document the immediate technical facts; they do not, and cannot from the available data, fully explain the actor's motive or ultimate objective.
Read the original ReversingLabs‑based report at The Hacker News: https://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.html
