A malicious npm package named “tw-pkgprobe-7731” was uploaded to the npm registry in mid-August 2026, masquerading as a Twilio bug-bounty security probe tool to harvest credentials from developers integrating Twilio APIs.
Security researchers disclosed the package on September 22, 2026. The package was uploaded by the npm account “twdepprobe7731” and targeted developers working with Twilio by impersonating a legitimate security testing utility.
tw-pkgprobe-7731 Uploaded Mid-August by npm Account twdepprobe7731
The malicious package appeared on the npm registry in mid-August 2026 under the name “tw-pkgprobe-7731.” The package name and description were crafted to resemble a Twilio-sanctioned security tool used for bug bounty program testing.
Developers integrating Twilio services into applications often search npm for Twilio-related packages to streamline API authentication, SMS handling, or voice call functionality. The malicious package exploited this search behavior by positioning itself as a security probe tool—a category of package that developers might install during testing or security audits.
Credential Harvesting Payload Targets Twilio API Developers
The package’s malicious payload harvests sensitive credentials and data from the developer’s environment. When installed, the package executes code designed to extract API keys, authentication tokens, and other credentials stored in environment variables, configuration files, or application memory.
Developers integrating Twilio APIs typically store account SIDs, auth tokens, and API keys in their local development environments. These credentials grant access to Twilio account resources, including messaging services, phone number provisioning, and usage billing. Compromise of these credentials allows attackers to send messages, place calls, or access call logs from the victim’s Twilio account.
The package’s impersonation strategy increases the likelihood of installation. A developer searching for Twilio-related security tools or testing utilities might install “tw-pkgprobe-7731” based on its name and description, bypassing scrutiny that an obviously malicious package name would trigger.
Disclosed September 22 After Multi-Week Exposure Window
Security researchers disclosed the malicious package on September 22, 2026. The mid-August upload date means the package remained available on the npm registry for several weeks before detection and disclosure.
The duration between upload and disclosure creates an exposure window during which developers may have installed the package. Organizations that installed “tw-pkgprobe-7731” during this period face credential compromise and must rotate Twilio API credentials, audit account activity for unauthorized messaging or calls, and review application logs for evidence of data exfiltration.
npm Registry Typosquatting and Impersonation Challenges
The tw-pkgprobe-7731 incident illustrates the persistent challenge of malicious package detection in open registries. npm hosts over two million packages, and the platform’s open submission model allows any account to publish packages with minimal vetting before availability.
Attackers craft package names and descriptions to mimic legitimate tools, exploit developer search behavior, or target specific developer communities. In this case, the Twilio branding and bug-bounty security tool framing created a plausible pretext for installation.
The uploading account, “twdepprobe7731,” used a naming convention that superficially resembles internal testing or probe accounts. Developers encountering the package in search results might interpret the account name as a Twilio-affiliated or authorized testing identity rather than a malicious actor.
npm’s automated malware detection systems and community reporting mechanisms eventually flagged the package, but the multi-week exposure window demonstrates the gap between upload and detection. Developers bear the burden of verifying package authenticity, reviewing source code before installation, and monitoring dependency trees for suspicious additions.
Organizations using Twilio APIs should audit their npm dependencies for the presence of “tw-pkgprobe-7731” in package-lock.json or node_modules directories. If the package was installed, immediate credential rotation is required, followed by review of Twilio account activity logs for unauthorized messaging, call placement, or billing anomalies.
The package should be removed from the npm registry following disclosure. Developers who installed the package must also scan their local environments and build systems for additional malicious artifacts or persistence mechanisms the package may have deployed during execution.
