Fake Twilio Bug-Bounty Tool Hid Credential Theft in npm

A package uploaded to npm under the name tw-pkgprobe-7731 spent 11 versions posing as an authorized Twilio bug-bounty tool before a later version began exfiltrating the Twilio API credentials of any developer who installed it, according to research ReversingLabs published Sept. 22, 2026.

Eleven versions in 45 minutes

Software threat researcher Lucija Valentić wrote in ReversingLabs' blog that the npm account behind the package, twdepprobe7731, published all 11 versions on Aug. 14, 2026, in roughly 45 minutes. Version 1.0.0's code described itself in comments as an "Authorized bug-bounty research probe (Twilio HackerOne program)" that "runs only inside Twilio's serverless packager sandbox" and takes "no destructive action," while actually collecting environment variables, system mounts and temporary-folder paths and sending them out over a webhook.

The credential theft arrived in version four

The package's behavior shifted with each release. Versions 1.0.1 through 1.0.3 searched infected systems for folders tied to specific Twilio account identifiers. Version 1.0.4 added the credential theft: it read process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, the two values that authenticate against Twilio's API, and sent them over the same webhook. The final versions, 1.0.8 through 1.1.1, dropped the credential grab and instead probed Twilio-related hosts and queried AWS's metadata endpoint at 169.254.169.254 without exfiltrating what they found.

Version	Behavior
1.0.0	Claimed authorized Twilio probe; collected environment and system data
1.0.4	Exfiltrated ACCOUNT_SID and AUTH_TOKEN over a webhook
1.1.1	Probed hosts and AWS metadata; no exfiltration observed

The cover story didn't match Twilio's actual rules

Valentić attributed the campaign to "a less sophisticated threat actor," noting the packages used no obfuscation, no typosquatted name resembling a real Twilio package, and an account with no history to lend it credibility. The comments describing an "authorized" probe did not match Twilio's own published rules for its HackerOne bug-bounty program, which is what first told ReversingLabs the claim was false rather than simply undisclosed research.

Twilio said in a statement reported by The Hacker News that it "has not experienced a security incident, and our systems and customer data remain secure and uncompromised," and that npm has removed the packages. The company added that it "will never ask you to install a package, script, or tool from outside our official documentation to verify or secure your account."

The npm registry has absorbed several branded-impersonation campaigns in 2026. A separate campaign this month used fake LastPass GitHub repositories to push a kernel-level credential stealer, and the Shai-Hulud worm returned to npm in September after a 111-day gap, reusing its self-propagating technique from the first outbreak. Neither campaign shares code or infrastructure with tw-pkgprobe-7731, but all three rely on the same trust developers place in a package name that looks like it belongs to a real company's security program.

Developers who installed any of the 11 versions between Aug. 14 and the takedown should rotate their Twilio account SID and auth token regardless of which version they ran.