Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials

Summary: A malicious npm package named "tw-pkgprobe-7731" was uploaded to the registry in mid-August 2026 by an account called "twdepprobe7731," which published 11 versions in about 45 minutes and no longer exists. The package posed as an authorized Twilio bug-bounty probe, checked for a Twilio developer environment before extracting environment variables and system details for exfiltration via webhook, and later versions added exfiltration of process.env.ACCOUNT_SID and process.env.AUTH_TOKEN.
Bottom line: Version 1.0.4 targeted the Twilio account SID and auth token, which ReversingLabs says could let a threat actor authorize billing and trigger communications on a victim's account. ReversingLabs also noted the packages violated Twilio's HackerOne bug-hunting guidelines, and Twilio says it will never ask developers to install a package from outside its official documentation to verify or secure an account.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026