Cybersecurity experts have revealed a harmful npm package named “tw-pkgprobe-7731” which pretends to be a security tool but aims to collect sensitive data from developers using Twilio. This package was uploaded to the npm registry in mid-August 2026 by an account named “twdepprobe7731.” Over a span of 45 minutes, 11 versions of the package were released, though the associated account has since been deleted.
Malicious Intent Behind the Package
Initially, the “tw-pkgprobe-7731” package posed as an authorized security tool meant for research purposes, as noted by ReversingLabs researcher Lucija Valentić. The package claimed to operate within Twilio’s serverless environment, collecting local data without performing any destructive actions. However, it was designed to confirm if it was running in a Twilio developer setup and would exit otherwise.
If the package detected a suitable environment, it would extract system information, including environment variables and configuration details, and transmit this data through a webhook. Subsequent versions of the package focused on Twilio API users, particularly targeting folders linked to specific Twilio account identifiers. If a folder matched a target, the package would inject a custom npm proof-of-concept package.
Evolving Threat Capabilities
Version 1.0.4 of the package expanded its capabilities to exfiltrate critical credentials like process.env.ACCOUNT_SID and process.env.AUTH_TOKEN. This functionality posed significant risks, enabling unauthorized billing and communication via compromised Twilio credentials. However, later versions, specifically 1.0.8, 1.1.0, and 1.1.1, reverted to the package’s initial probing functionalities, stripping away the malicious elements seen in earlier updates.
Additionally, the final versions engaged in open-source intelligence gathering, probing various Twilio-related hosts and retrieving AWS metadata. These actions further complicated understanding the package’s ultimate objectives, raising questions about its association with any legitimate bug bounty program.
Implications and Security Concerns
ReversingLabs noted that the package’s operations violated Twilio’s established security research guidelines, indicating malicious intent. The package’s development was unsophisticated, lacking measures like obfuscation or attempts to appear legitimate, commonly seen in previous malicious campaigns. This may suggest a less experienced threat actor was responsible for the attack targeting Twilio developers.
The situation underscores the importance of vigilance in software security, particularly for developers integrating third-party tools. As cybersecurity threats evolve, developers must remain alert to ensure the integrity and safety of their systems.
