Ethical Hacking News
A recent discovery by cybersecurity researchers has revealed a malicious npm package that masqueraded as a security tool, targeting developers who integrate Twilio into their applications. The package, named "tw-pkgprobe-7731," was found to exfiltrate sensitive Twilio credentials, compromising the victim's security and potentially allowing the threat actor to authorize billing and trigger communication. The incident highlights the importance of supply chain security and the need for developers to be vigilant when integrating third-party libraries into their applications.
The malicious npm package "tw-pkgprobe-7731" was uploaded to the npm registry in mid-August 2026 by an npm account. The package was designed to harvest sensitive data from affected applications, including environment variables, system details, and configurations. The package focused on developers using Twilio APIs, searching for specific folders tied to Twilio account SIDs. A notable version introduced the ability to exfiltrate Twilio credentials, compromising the victim's account. The threat actor behind the campaign made no effort to obscure malicious code or hide their activity, indicating a less sophisticated threat actor. The incident highlights the importance of supply chain security and the need for developers to be vigilant when integrating third-party libraries. The discovery serves as a wake-up call for the cybersecurity community, emphasizing the need for security awareness and education among developers.
A recent discovery by cybersecurity researchers has shed light on a malicious npm package that masqueraded as a security tool, targeting developers who integrate Twilio into their applications. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731." In total, 11 versions of the package were published in quick succession on the same day over an approximately 45-minute time period. The npm user account no longer exists as of writing.
The malicious package was designed to harvest sensitive data from the affected applications, including environment variables, system details, and configurations. The gathered information was then exfiltrated via a webhook. Upon execution, the package first checks if the current environment is a Twilio developer environment. If that's not the case, it immediately exits.
However, subsequent versions of the package have been found to focus on developers using Twilio APIs, specifically searching for folders tied to specific Twilio account String Identifiers (SIDs). Most importantly, it avoids taking any action if there exists a folder with a specific SID name. Otherwise, if matching target folders were found, it scanned installed npm packages and node_modules to inject a custom npm PoC package, creating package.json and index.js inside.
A notable version, 1.0.4, introduced an added capability to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN, effectively compromising the victim's Twilio credentials and potentially allowing the threat actor to authorize billing and trigger communication.
Despite the unusual course reversals, the threat actor behind the campaign attempted to mask malicious features in certain releases by surrounding them with seemingly benign features and code. However, ReversingLabs researchers stated that the packages did not follow Twilio's bug hunting guidelines, which suggests that the packages had malicious intent. The researchers also noted that the threat actor made no real effort to obscure the malicious code or hide their activity, indicating a less sophisticated threat actor responsible for the malicious campaign targeting Twilio developers.
The discovery of this malicious npm package serves as a reminder of the importance of supply chain security and the need for developers to be vigilant when integrating third-party libraries into their applications. The incident highlights the potential risks of using compromised or malicious npm packages, which can have severe consequences for the security and integrity of an organization's systems and data.
The incident also underscores the need for improved security awareness and education among developers, particularly those who work with sensitive technologies like Twilio. Developers must be aware of the potential risks associated with using third-party libraries and take steps to mitigate these risks, such as keeping their dependencies up-to-date and using reputable package managers.
In conclusion, the discovery of the malicious npm package "tw-pkgprobe-7731" serves as a wake-up call for the cybersecurity community, highlighting the importance of supply chain security and the need for developers to be vigilant when integrating third-party libraries into their applications. As the threat landscape continues to evolve, it is essential that organizations prioritize security awareness and education, as well as implementing robust security measures to protect against malicious activity.
Related Information:
https://www.ethicalhackingnews.com/articles/Malicious-npm-Package-Exfiltrates-Sensitive-Twilio-Credentials-A-Supply-Chain-Attack-Revelation-ehn.shtml
https://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.html
Published: Tue Sep 22 15:35:54 2026 by llama3.2 3B Q4_K_M
