Disguised as a Twilio Security Scanner: npm Package tw-pkgprobe-7731 Steals Account SID and Auth Token
Security researcher Lucija Valentić (ReversingLabs) spotted an npm package called tw-pkgprobe-7731 that posed as an authorized Twilio bug-bounty tool. In reality it exfiltrated environment variables and specifically hunted for Twilio credentials. The publishing npm account no longer exists, but the package stayed installable for weeks.
What happened?
An npm account named twdepprobe7731 published eleven versions of the tw-pkgprobe-7731 package within 45 minutes in August 2026. The package posed as a tool for authorized security research under Twilio's bug-bounty program, specifically targeting developers who integrate Twilio into their applications. ReversingLabs researcher Lucija Valentić identified and reported the package; the analysis was published on September 22, 2026 and updated on September 23, 2026. The publishing account no longer exists, but the package remained installable for several weeks without any countermeasure.
How does the campaign work?
Early versions of the package (1.0.0 through 1.0.3) extracted environment variables and system details on import and sent them via webhook to an attacker-controlled endpoint. Starting with version 1.0.4, the behavior got more targeted: the package explicitly searched for process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, the two core Twilio API credentials, and exfiltrated them when found. Later versions added the ability to fetch and install additional malicious npm packages.
Notably, the package probed internal Twilio hostnames such as support-api.us1.twilio.com, kafka-ui.au1.twilio.com and litellm.ai-services.corp.twilio.com. That suggests the attackers were specifically hunting for Twilio-internal services, possibly to verify stolen credentials against real internal endpoints.
Why this matters for DevSecOps teams
Stolen Twilio credentials let an attacker send SMS and voice calls under the victim account, manipulate billing, and potentially reach further connected communication infrastructure. For teams using Twilio in TYPO3, Symfony or Sylius applications for two-factor authentication, notifications or checkout confirmations, a compromised account means direct financial damage and potential abuse of your own communication channels against your customers.
This case fits a growing pattern: malicious packages that pose specifically as security or testing tooling for a given vendor, to reach exactly the audience that already handles that vendor's credentials.
What you should do
Check whether tw-pkgprobe-7731 shows up in your lockfiles:
grep -r "tw-pkgprobe-7731" package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
npm ls tw-pkgprobe-7731 2>/dev/null
If the package was installed, rotate your Twilio Account SID and Auth Token in the Twilio console immediately, and review your billing and usage logs for unusual SMS or call activity. More generally, use scoped API keys instead of global account credentials, enable dependency scanning with lockfile checks in your CI/CD pipeline, and review install scripts of new dependencies before first install, especially for packages that present themselves as security tooling for a specific third-party vendor.
Sources
I review dependencies and CI/CD pipelines of TYPO3 and Sylius projects on an ongoing basis for npm supply-chain risk.
Dependency audits, lockfile monitoring, hardening third-party integrations such as Twilio, Stripe or Mollie.
Platform operations, not paper advice: I review, patch and harden your infrastructure on an ongoing basis.