Malicious npm Package 'tw-pkgprobe-7731' Impersonates Twilio Tool to Steal Credentials
A malicious npm package, 'tw-pkgprobe-7731,' was discovered masquerading as a Twilio security tool, designed to exfiltrate developer credentials and sensitive system information.
Cybersecurity researchers have uncovered a sophisticated supply chain attack involving a malicious npm package named 'tw-pkgprobe-7731.' This package was designed to impersonate a legitimate Twilio security tool, tricking developers into installing it and subsequently exfiltrating sensitive credentials and system information.
The package first appeared on the npm registry in mid-August 2026, uploaded by an account named 'twdepprobe7731.' Over a short period of approximately 45 minutes, 11 different versions of the package were published. The associated npm user account has since been removed.
Initially, the first version of 'tw-pkgprobe-7731' presented itself as an "Authorized bug-bounty research probe (Twilio HackerOne program)." Its internal comments claimed it would "run only inside Twilio's serverless packager sandbox" and "collect local process/host context and write it next to itself; no destructive action." This deceptive description aimed to lull developers into a false sense of security.
Upon execution, the malware performs a crucial check: it verifies if the current environment is a Twilio developer environment. If this condition is not met, the package exits without taking any further action. This targeted approach suggests the attackers were specifically aiming for Twilio developers.
If the environment check passes, the malicious package proceeds to gather sensitive data. It extracts environment variables and collects system details such as mounted drives, temporary folders, and various configuration files. This collected information is then exfiltrated to the attacker via a webhook.
Later versions of the package, specifically 1.0.1 through 1.0.3, focused on developers utilizing Twilio APIs. They actively searched for directories associated with specific Twilio Account String Identifiers (SIDs). Notably, these versions would avoid malicious activity if a folder with a specific SID name already existed. More critically, version 1.0.4 introduced the capability to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, directly compromising Twilio credentials and enabling potential unauthorized billing and communication.
Interestingly, the final versions of the package (1.0.8, 1.1.0, and 1.1.1) reverted to a more basic probing profile, dropping the credential-stealing functionality. These later versions also engaged in open-source intelligence (OSINT) gathering by probing various Twilio-related hosts and even fetching AWS metadata from 169.254.169.254/latest/meta-data/. The reasons behind these functional reversals remain unclear, leaving open questions about the ultimate goals of the campaign.
Despite the attempts to mask malicious features in some releases, researchers at ReversingLabs noted that the package versions did not adhere to Twilio's bug hunting guidelines. This violation strongly suggests malicious intent rather than legitimate security research. The lack of obfuscation and the straightforward nature of the attack indicate that the threat actor may be less sophisticated than those typically seen in advanced supply chain attacks.