Developers integrating Twilio into their applications must stay vigilant after a malicious npm package named tw-pkgprobe-7731 surfaced, posing as an official bug bounty tool while stealthily harvesting sensitive data.
Introduced in mid-August 2026 under the npm account twdepprobe7731, tw-pkgprobe-7731 saw 11 versions released within about 45 minutes. Shortly after publication, the publishing account was removed. The earliest edition claimed to be part of an “authorized” Twilio HackerOne program security probe, and described itself as gathering environment context without taking destructive action.
What It Did Under the Hood
The package first checks whether it is running in a Twilio developer environment; if not, it exits immediately. In cases where the environment matches, it collects environment variables, system configuration data (such as mounts and temp folders), then sends that information out via a webhook.
Later versions (notably 1.0.1 through 1.0.3) zeroed in on Twilio users by scanning for folders tied to specific Twilio account SIDs. If no folder with the targeted SID was found, the package proceeded to inject a proof-of-concept package into node_modules, creating its own package.json and index.js.
Version 1.0.4 significantly escalated the risk: it exfiltrated critical Twilio credentials like process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, which could allow attackers to authorize billing and send communications. Subsequent releases (1.0.8, 1.1.0, 1.1.1) stripped away that credential-stealing functionality and reverted to simpler probing behaviors, including gathering OSINT from Twilio-related hosts and fetching AWS instance metadata.
Intent, Risk & Detection
The motives behind these rapid changes remain unclear. The package never followed Twilio’s official vulnerability disclosure or bug-bounty rules. The code displayed no real effort at obfuscation and had no typographical trickery or impersonation of legitimate accounts. Experts suggest the actor behind it likely lacked sophistication but still intended harm.
Developers are urged to verify the source and behavior of npm packages—checking version histories and permission models—especially when integrating critical services like Twilio. Notably, legitimate Twilio bug bounty tools follow explicit guidelines and normally avoid private credential extraction.
Security tooling vendors should monitor unusual npm account behavior, especially mass-publishing multiple versions in quick succession, or packages that perform environment checks designed to hide their malicious behavior outside certain execution contexts.
Overall, this incident highlights the increasing risk of supply-chain attacks within the node.js/npm ecosystem, especially targeting sensitive infra like Twilio. Crisis response needs include better detection of credential exfiltration, closer scrutiny of third-party packages, and tighter compliance with bug bounty programs’ terms.
What this means: this malicious package demonstrates how attackers are veering toward mimicking legitimate security processes—bug bounty research—to gain trust, while embedding dangerous functionality. Developers relying on npm packages should audit their dependencies carefully and monitor for unexpected behavior, particularly when credentials or account identifiers are involved. Supply-chain security is now inseparable from maintaining safe and trustworthy software development.
