Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating **Twilio** into their applications, while stealthily attempting to harvest sensitive data. The package, named "tw-pkgprobe-7731," was first uploaded to the npm registry in mid-August 2026 by an npm account named "twdepprobe7731." In total, 11 versions of the package were published in quick succession on the same day over an approximately 45-minute time period. The npm user account no longer exists as of writing. "The first version of tw-pkgprobe-7731 posed as an authorized security research probe," **ReversingLabs** researcher **Lucija Valentić** said in a report published today. "Comments inside the package describe it as an 'Authorized bug-bounty research probe (**Twilio** **HackerOne** program)' that 'runs only inside **Twilio**'s serverless packager sandbox' and 'collects local process/host context and writes it next to itself; no destructive action.'" Upon execution, the package first checks if the current environment is a **Twilio** developer environment. It immediately exits if that's not the case. Should the check pass, the malware proceeds to extract environment variables along with system details like mounts, temporary folders, and various configurations. The gathered information is then exfiltrated via a webhook. Subsequent versions of the npm package (viz., versions 1.0.1, 1.0.2, and 1.0.3) have been found to focus on developers using **Twilio** APIs, specifically searching for folders tied to specific **Twilio** account String Identifiers (SIDs). Most importantly, it avoids taking any action if there exists a folder with a specific SID name. "Otherwise, if matching target folders were found, it scanned installed npm packages and node_modules to inject a custom npm PoC package, creating package.json and index.js inside," **ReversingLabs** explained.  Version 1.0.4 is said to have introduced an added capability to exfiltrate `process.env.ACCOUNT_SID` and `process.env.AUTH_TOKEN`, effectively compromising the victim's **Twilio** credentials and potentially allowing the threat actor to authorize billing and trigger communication. However, the final three versions (i.e., 1.0.8, 1.1.0, and 1.1.1) "reverted to the basic probing profile of the package seen in version 1.0.0," dropping the malicious functionality incorporated in prior iterations. In addition, the last two versions have been found to conduct **OSINT** gathering by probing various **Twilio**-related hosts, such as `support-api.us1.twilio[.]com`, `kafka-ui.au1.twilio[.]com` and `litellm.ai-services.corp.twilio[.]com`, even fetching **AWS** metadata located at `169.254.169[.]254/latest/meta-data/`. Given these unusual course reversals, it's unclear what the end goals are and if it was published as part of a bug bounty program. However, **ReversingLabs** said the package versions did not follow **Twilio**'s bug hunting guidelines listed on **HackerOne**. "In other words, these packages clearly violate the basic security research guidelines **Twilio** established, which suggests that the packages had malicious intent," **Valentić** said. "While the threat actor behind the campaign attempted to mask malicious features in certain releases by surrounding them with seemingly benign features and code, they made no real effort to obscure the malicious code or hide their activity." "There is no obfuscation, typosquatting, or attempt to make the publishing npm account look legitimate – tactics we’ve routinely seen in previous campaigns. This suggests that a less sophisticated threat actor is responsible for the malicious campaign targeting **Twilio** developers."