Fake Twilio npm Probe Hid Credential Theft

A package that looked like a sanctioned security test quietly reached into developer environments and tried to walk off with Twilio account credentials. ReversingLabs disclosed details of a malicious npm package called "tw-pkgprobe-7731" that presented itself as a bug-bounty probe aimed at developers wiring Twilio into their applications.

The package first appeared on the npm registry in mid-August 2026, uploaded by an account named "twdepprobe7731." Before the account vanished, it published 11 versions of the package in a single day, all inside roughly 45 minutes.

A probe that checked for Twilio first

According to ReversingLabs, the earliest version was dressed up as legitimate research. "The first version of tw-pkgprobe-7731 posed as an authorized security research probe," ReversingLabs researcher Lucija Valentić said in a report published today.

Valentić described the package's own comments: "Comments inside the package describe it as an 'Authorized bug-bounty research probe (Twilio HackerOne program)' that 'runs only inside Twilio's serverless packager sandbox' and 'collects local process/host context and writes it next to itself; no destructive action.'"

The disguise came with a gate. Before doing anything else, the code checked whether it was running in a Twilio developer environment. If that check failed, the package exited immediately. Only when the environment looked right did it move on to collect environment variables and system details such as mounts, temporary folders, and configurations, then send the results out through a webhook.

Later versions hunted account folders

The follow-on releases, versions 1.0.1, 1.0.2, and 1.0.3, shifted focus toward developers using Twilio APIs. Those builds searched for folders tied to specific Twilio account String Identifiers, or SIDs. If a folder named after a particular SID was already present, the package did nothing. When matching folders turned up, it scanned installed npm packages and node_modules directories and injected a custom npm proof-of-concept package, creating package.json and index.js files along the way.

Version 1.0.4 went further, adding a routine to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN — the credentials that let an application talk to Twilio on a customer's behalf. With those values in hand, an attacker could authorize billing activity and trigger communications, effectively operating as the victim's account.

Then the code walked backward

The campaign did not keep escalating. The last three versions, 1.0.8, 1.1.0, and 1.1.1, reverted to the basic probing profile seen back in version 1.0.0, dropping the credential theft and injection behavior added in between.

Those final two releases also performed open-source intelligence gathering, probing Twilio-related hosts including support-api.us1.twilio[.]com, kafka-ui.au1.twilio[.]com, and litellm.ai-services.corp.twilio[.]com. They also fetched AWS metadata from the address 169.254.169[.]254/latest/meta-data/.

ReversingLabs said the odd back-and-forth makes the end goal unclear, and it is not known whether the package was published as part of a bug bounty program. What the researchers could measure was the rulebook: the releases did not follow Twilio's bug hunting guidelines listed on HackerOne.

Rules the package ignored

"In other words, these packages clearly violate the basic security research guidelines Twilio established, which suggests that the packages had malicious intent," Valentić said.

She also noted how little effort went into hiding the operation. "While the threat actor behind the campaign attempted to mask malicious features in certain releases by surrounding them with seemingly benign features and code, they made no real effort to obscure the malicious code or hide their activity," she said.

"There is no obfuscation, typosquatting, or attempt to make the publishing npm account look legitimate – tactics we've routinely seen in previous campaigns," Valentić added. "This suggests that a less sophisticated threat actor is responsible for the malicious campaign targeting Twilio developers."

That absence of tradecraft is itself a detail. Typosquatting and fabricated publisher identities are common ways supply-chain attacks buy time before anyone notices. Here, the account name was left as-is and the code was left readable, even as the package borrowed the language of an authorized program to explain itself.

What the package collected

The mechanics stayed within the normal reach of an npm install that runs code at install or execution time. The package read process environment variables, which in a Twilio development setup can include account identifiers and authentication tokens. It also gathered host-level context — mounted filesystems, temporary directories, and configuration data — that can reveal how a build or deployment machine is set up, what services it talks to, and where credentials might live.

When it targeted specific Twilio SIDs, the package looked for folder structures that suggested real account usage, then wrote its own npm package files into the dependency tree. Creating package.json and index.js files gives injected code a place to be picked up by later installs or builds, a technique that can extend a foothold beyond the original execution.

The OSINT phase in the later builds pointed at Twilio-related infrastructure by name and also at the AWS instance metadata endpoint, a well-known target for anyone trying to lift cloud role credentials from a host. Whether those probes returned anything useful is not stated in the report.

The short life of a suspicious account

Timing is part of the story. All 11 versions landed on the same day in mid-August 2026, spread across about 45 minutes. That kind of rapid-fire publishing can suggest automated tooling or a hurried attempt to iterate on working code, and it leaves a compact trail for defenders to review.

The npm user account behind the uploads no longer exists as of the report. The takedown removes the publisher, but it does not tell defenders which environments may have pulled the package down while it was live, or what the collected data was used for.

• 11 versions of the package were published in quick succession.
• The releases arrived on a single day in mid-August 2026, over roughly 45 minutes.
• Version 1.0.4 added exfiltration of ACCOUNT_SID and AUTH_TOKEN.
• Three final versions — 1.0.8, 1.1.0, and 1.1.1 — reverted to the basic profile from 1.0.0.

Why the numbers matter

For anyone auditing a build pipeline, the version list is the practical artifact. It shows a package that changed purpose across releases: an initial probe, then targeted folder discovery, then credential theft, then a return to simple probing. Checking logs for installs of tw-pkgprobe-7731 during that window is the direct way to know whether a project touched it.

The environment check adds a wrinkle for incident responders. Because the early builds exited outside Twilio-like environments, an install on an ordinary developer laptop may have produced no obvious behavior, while an install on a machine configured for Twilio work would proceed to collection. That distinction can make a casual review of a dependency tree look clean when it is not.

The stolen values — account SID and auth token — are the keys to a Twilio account's programmatic access. Rotating them invalidates anything an attacker may have lifted. That is the defensive action the exposed values point to, and it depends on knowing the package ran at all.

What this suggests for dependency trust

This incident is a reminder that a package's own description is not evidence of authorization. The comments inside tw-pkgprobe-7731 claimed it ran only inside a Twilio sandbox and collected context without destructive action. The later versions did more than the comments described, and the releases did not match the bug-hunting rules Twilio publishes on HackerOne.

For developers, the exposure path runs through ordinary dependency installation rather than a dramatic exploit. A package that inspects its environment, reads environment variables, and writes files into node_modules is doing things that deserve attention in review, even when it arrives with the vocabulary of a sanctioned test.

The report also leaves open questions that matter for anyone trying to assess impact. The end goal is unclear, and it is not known whether the work was tied to a bug bounty program. Those gaps, plus the fact that this account of the campaign comes from a single research team, mean the picture of intent is still incomplete.

What is documented is the sequence: an upload in mid-August 2026, 11 versions in about 45 minutes, a Twilio environment check, collection of environment and host data, SID-targeted folder discovery, credential exfiltration in version 1.0.4, and a retreat to basic probing in the last three releases. The npm account is gone. The package name is on the record.