Affected Systems

npm package "tw-pkgprobe-7731" (versions 1.0.0 through 1.1.1, published mid-August 2026). Targets developers using Twilio APIs in Node.js environments. Specifically exfiltrates ACCOUNT_SID and AUTH_TOKEN environment variables from Twilio integrations.

Exploitation Status

Package was live on npm registry in mid-August 2026 with 11 versions published. The malicious npm account "twdepprobe7731" has since been removed. No evidence of widespread compromise reported, but package was publicly available and functional. Active credential theft capability confirmed in versions 1.0.1-1.0.4.

Business Impact

Developers who installed tw-pkgprobe-7731 may have exposed Twilio API credentials (ACCOUNT_SID and AUTH_TOKEN), enabling attackers to authorize billing, trigger communications, and access Twilio account resources. The package performed environment checks to target only Twilio development environments and exfiltrated data via webhook. Later versions also conducted OSINT probing of internal Twilio infrastructure and AWS metadata endpoints. Low sophistication suggests opportunistic threat actor rather than advanced persistent threat.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Search npm package-lock.json and node_modules directories for 'tw-pkgprobe-7731' across all development and CI/CD environments
  • Rotate all Twilio ACCOUNT_SID and AUTH_TOKEN credentials if the package was present in any environment
  • Review Twilio account activity logs from mid-August 2026 onward for unauthorized API calls, billing changes, or communication triggers
  • Audit npm install logs and webhook/egress traffic for connections to attacker-controlled endpoints during the August 2026 timeframe
  • Implement npm package verification policies requiring review of new dependencies, especially those claiming security research or vendor affiliation

---

# Threat Actor Context

Actor Profile

The threat actor behind account "twdepprobe7731" uploaded 11 versions of the malicious npm package "tw-pkgprobe-7731" to the npm registry in mid-August 2026 over approximately 45 minutes. The actor posed the package as an authorized Twilio HackerOne bug bounty probe to gain legitimacy. Analysis suggests a less sophisticated threat actor, as the campaign lacked common obfuscation techniques, typosquatting, or attempts to make the publishing account appear legitimate—tactics routinely observed in more advanced supply chain attacks. The actor's motivation appears to be credential harvesting from developers integrating Twilio APIs, specifically targeting Twilio account SIDs and authentication tokens to potentially enable unauthorized billing and communications. The npm account has since been removed.

TTPs (Tactics, Techniques, Procedures)

T1195.002 (Compromise Software Supply Chain): Malicious npm package uploaded to public registry. T1059.007 (Command and Scripting Interpreter: JavaScript): Malicious code executed via Node.js package installation. T1083 (File and Directory Discovery): Scanned for Twilio-specific folders tied to account SIDs and enumerated node_modules directories. T1082 (System Information Discovery): Collected system details including mounts, temporary folders, and configurations; probed AWS metadata endpoint at 169.254.169.254. T1552.001 (Unsecured Credentials: Credentials In Files): Targeted process.env.ACCOUNT_SID and process.env.AUTH_TOKEN environment variables. T1071.001 (Application Layer Protocol: Web Protocols): Exfiltrated data via webhook. T1027 (Obfuscated Files or Information): Notably absent—no obfuscation employed. T1036.005 (Masquerading: Match Legitimate Name or Location): Posed as authorized Twilio security research tool.

Targets & Patterns

The campaign specifically targeted software developers and technology sector professionals integrating Twilio communication APIs into their applications. The malware performed environment checks to verify it was running in a Twilio developer environment before executing malicious payloads. Later versions (1.0.1-1.0.3) searched for folders tied to specific Twilio account SIDs, avoiding action if a particular SID folder existed, suggesting targeted reconnaissance or allowlisting of specific accounts. Version 1.0.4 escalated to credential theft by exfiltrating ACCOUNT_SID and AUTH_TOKEN environment variables, enabling potential account takeover, unauthorized billing, and abuse of communication services. The final versions conducted OSINT by probing internal Twilio infrastructure hosts including support-api.us1.twilio.com, kafka-ui.au1.twilio.com, and litellm.ai-services.corp.twilio.com, plus AWS metadata endpoints, indicating reconnaissance of Twilio's internal architecture.

Historical Context

This campaign represents part of the ongoing trend of supply chain attacks targeting developer ecosystems through malicious npm packages. However, it differs from more sophisticated campaigns in its lack of obfuscation, typosquatting, or legitimacy-building tactics around the publishing account. The rapid publication of 11 versions within 45 minutes, followed by functionality reversals in later versions (1.0.8, 1.1.0, 1.1.1 reverted to basic probing), suggests experimental or iterative development. The false claim of being part of Twilio's HackerOne bug bounty program—while violating Twilio's published security research guidelines—represents a social engineering tactic to provide cover for malicious activity. No direct links to previously documented threat actors or campaigns were identified in the available data.

Defensive Recommendations

  • Implement npm package vetting processes: Review package provenance, publisher reputation, and download statistics before installing dependencies, especially those claiming security research purposes
  • Monitor environment variable access (T1552.001): Deploy runtime application self-protection (RASP) or endpoint detection to alert on suspicious access to ACCOUNT_SID, AUTH_TOKEN, and other credential environment variables
  • Detect outbound webhook exfiltration (T1071.001): Implement network egress filtering and monitor for unexpected HTTP POST requests from Node.js processes to unfamiliar domains
  • Scan for file and directory discovery activity (T1083): Use EDR solutions to detect enumeration of node_modules directories and searches for vendor-specific folder patterns like Twilio SIDs
  • Block AWS metadata endpoint access (T1082): Restrict access to 169.254.169.254 from developer workstations and non-production environments using host-based firewalls or network segmentation
  • Enable npm audit and dependency scanning: Integrate tools like npm audit, Snyk, or Socket.dev into CI/CD pipelines to identify known malicious packages before deployment