Cybersecurity
npm package poses as Twilio probe, steals credentials
ReversingLabs said the package tw-pkgprobe-7731 mimicked a Twilio bug-bounty tool, while later versions probed Twilio-related systems and one release sought ACCOUNT_SID and AUTH_TOKEN from the environment.
- ReversingLabs said tw-pkgprobe-7731 was first uploaded to npm in mid-August 2026 by an account named twdepprobe7731, and 11 versions were published in about 45 minutes.
- Lucija Valentić said the first release presented itself as an authorised security probe for Twilio's bug-bounty programme.
- When the package ran in a Twilio developer environment, it collected environment variables and system details and sent them out through a webhook.
- ReversingLabs said versions 1.0.1 to 1.0.3 searched for Twilio SID-named folders, version 1.0.4 added code to take ACCOUNT_SID and AUTH_TOKEN, and versions 1.0.8, 1.1.0 and 1.1.1 returned to the earlier probing behaviour.
ReversingLabs said tw-pkgprobe-7731 was first uploaded to npm in mid-August 2026 by an account named twdepprobe7731. The firm said 11 releases appeared in roughly 45 minutes, and the account no longer existed when the report was written.
Lucija Valentić said the first version described itself as an approved research probe for Twilio's bug-bounty setup. It checked whether it was running in a Twilio developer environment, and if so it collected environment variables and system details before sending them through a webhook.
ReversingLabs said later versions 1.0.1, 1.0.2 and 1.0.3 looked for folders linked to Twilio SID values. If a matching folder was found, the package scanned installed npm packages and node_modules and wrote a proof-of-concept package into place.
The firm said version 1.0.4 added code to take ACCOUNT_SID and AUTH_TOKEN from the environment, which could expose Twilio credentials. It said the final versions, 1.0.8, 1.1.0 and 1.1.1, went back to the earlier probing pattern and also queried Twilio-related hosts and AWS metadata.
ReversingLabs said the releases did not follow Twilio's bug-hunting guidance on HackerOne. Valentić said the package showed no obfuscation or attempt to make the publishing account look legitimate, and the firm said that pointed to a less sophisticated threat actor.
Named in this story
People
- Lucija Valentić
- the ReversingLabs researcher who described the findings
Companies
- Twilio
- the developer ecosystem the package targeted and whose credentials were at risk
- ReversingLabs
- the security firm that reported the package
Organisations
- HackerOne
- the bug-bounty platform referenced in Twilio's published guidance
Products and systems
- tw-pkgprobe-7731
- the npm package that researchers said disguised itself as a Twilio probe
How the source tells it
The article was a routine threat-intelligence write-up, with some threat framing around concealment and credential theft but no overt hype.
- threat framing loaded wording cast the package as covert, malicious and credential-stealing
- uncertainty the piece stressed that the purpose and end goal were not clear