A malicious npm package that pretended to be a security research probe aimed at Twilio developers quietly tried to collect sensitive data, according to researchers at ReversingLabs.

The package, "tw-pkgprobe-7731," was uploaded to the npm registry in mid-August 2026 by an account called "twdepprobe7731." Eleven versions appeared within roughly 45 minutes on the same day. That account no longer exists.

The first release described itself in comments as an "Authorized bug-bounty research probe (Twilio HackerOne program)" that "runs only inside Twilio's serverless packager sandbox." On execution, it checked for a Twilio developer environment and quit if it did not find one. If the check passed, it pulled environment variables and system details such as mounts, temporary folders, and configurations, then sent the data out through a webhook.

Later versions (1.0.1 through 1.0.3) hunted for folders tied to Twilio account String Identifiers, and when matching folders turned up, scanned installed npm packages and node_modules to inject a custom npm PoC package. Version 1.0.4 added the ability to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, putting Twilio credentials at risk.

The final three versions (1.0.8, 1.1.0, 1.1.1) dropped the malicious features and returned to the basic probing seen in 1.0.0. The last two also probed Twilio-related hosts and fetched AWS metadata.

Researcher Lucija Valentić said the releases did not follow Twilio's bug hunting guidelines on HackerOne, suggesting malicious intent. She noted the actor made no effort to obscure the code or make the publishing account look legitimate, pointing to a less sophisticated threat actor.

Source: The Hackers News