A malicious npm package called tw-pkgprobe-7731 — uploaded in mid-August 2026 and published across 11 versions before its removal — disguised itself as an “Authorized bug-bounty research probe (Twilio HackerOne program)” to trick developers into running it. ReversingLabs researcher Lucija Valentić detailed how the package first checks whether it is running inside a Twilio developer environment; if not, it exits silently. If the check passes, it extracts environment variables, system details, and configuration data, then exfiltrates process.env.ACCOUNT_SID and process.env.AUTH_TOKEN — the master credentials for a developer’s Twilio account, which grant full API access including sending messages and making calls on the victim’s dime.
Later versions of the package went further, scanning for Twilio-specific project folders in the victim’s node_modules and injecting a secondary npm payload inside them. A final series of versions walked back the malicious functionality and pivoted to passive OSINT — probing internal Twilio-related hosts such as support-api.us1.twilio[.]com and kafka-ui.au1.twilio[.]com. The shifting behavior suggests the attacker may have been probing defenses or testing detection, and ReversingLabs noted the package clearly violates Twilio’s published bug-bounty rules, confirming malicious intent. The package has since been removed from the registry.
How to check if you’re affected
Affected products include any Node.js project that installed tw-pkgprobe-7731 (any version). Check your package.json and package-lock.json for that package name. If found, rotate your Twilio ACCOUNT_SID and AUTH_TOKEN in the Twilio Console immediately and audit recent API usage for unexpected SMS, voice, or messaging activity.