Malicious npm package targets Twilio developers with data-harvesting attempts

As outlined in The Hacker News, cybersecurity researchers at ReversingLabs have uncovered a malicious npm package named "tw-pkgprobe-7731" that was designed to appear as a security tool for developers using Twilio services. The package was uploaded to the npm registry in August 2026 and aimed to steal sensitive information.

The package, published by an now-deleted npm account, initially presented itself as an authorized bug-bounty probe for Twilio's HackerOne program. It was designed to run only within Twilio's serverless packager sandbox and collect local process and host context without performing destructive actions. However, upon execution, it first verified if it was running in a Twilio developer environment before proceeding. If the environment check passed, the malware extracted environment variables and system details, exfiltrating the data via a webhook.

Later versions specifically targeted Twilio account String Identifiers (SIDs) and attempted to inject a custom npm package into node_modules. Crucially, version 1.0.4 added the capability to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, potentially compromising Twilio credentials. The final versions reverted to a basic probing profile and conducted OSINT gathering, probing Twilio-related hosts and AWS metadata. Despite the apparent malicious intent, the package lacked typical obfuscation tactics, suggesting a less sophisticated threat actor.

Source: The Hacker News