Malicious npm Package Impersonates Twilio Security Tool to Target Developers

Malicious npm Campaign Targets Twilio Developers

A malicious npm campaign has targeted developers integrating Twilio by disguising a package as an authorized security research tool.

ReversingLabs said it discovered the package, tw-pkgprobe-7731, in August 2026. The package was not affiliated with Twilio and was published in 11 versions on August 14.

The researchers found that different versions of the package performed different activities, including collecting system and environment information, probing for Twilio-related resources, attempting to obtain Twilio API credentials, injecting files into npm projects, and probing internal Twilio-related hosts.

The packages were removed from npm about an hour after ReversingLabs notified npm.

The campaign highlights a broader software supply chain problem: developers can encounter malicious code not only in packages that openly advertise harmful functionality, but also in packages that present themselves as legitimate security or development utilities.

npm Malware Continues to Grow

ReversingLabs said the volume of malicious software appearing on public repositories continues to increase.

According to the company's tracking, npm saw approximately 5,308 unique malicious packages in 2024, excluding spam. By August 2026, the count had reached 5,723, exceeding the total recorded during all of 2024.

ReversingLabs also pointed to an increase in compromises involving trusted and popular packages.

The company cited the appearance of the Shai-Hulud npm worm in September 2025 and subsequent variants as part of a wider pattern involving open source supply chain attacks. Other campaigns have involved social engineering, maintainer account takeovers, infostealers, remote-access trojans and self-propagating worms.

npm has also announced plans for pre-publish scanning, which is intended to screen packages before they become publicly installable. The proposed checks include suspicious use of installation scripts, unexplained package archive changes and evidence of credential harvesting.

Despite these measures, malicious packages continue to appear.

What Is Twilio and Why Are Its Credentials Sensitive?

Twilio provides programmable communication services that developers can integrate into applications through web service APIs.

Its capabilities include phone calls, text messages, email and multi-factor authentication workflows. Developers can use Twilio APIs for functions such as sending two-factor authentication codes, routing calls and supporting identity verification through SMS-based one-time passwords.

Applications using Twilio can authenticate API requests with an ACCOUNT_SID and AUTH_TOKEN.

ReversingLabs noted that these credentials are sensitive because they can authorize API requests for a Twilio account. If compromised, attackers could potentially use them for unauthorized communications, OTP-related abuse or other unauthorized API activity, while also creating unexpected usage costs.

Twilio maintains systems intended to detect fraudulent use of its communications platform and provides guidance for developers on preventing abuse.

That makes the package's focus on Twilio credentials particularly significant from a supply chain security perspective.

The Malicious Package Posed as a Security Research Probe

The first version of tw-pkgprobe-7731 presented itself as an authorized security research probe.

Comments inside the package described it as a Twilio HackerOne research tool that would operate within a serverless sandbox and collect local process and host information.

However, ReversingLabs found different behavior after deployment.

The package first attempted to determine whether it was operating in a Twilio developer environment. If the environment did not match its criteria, it exited.

When the environment appeared relevant, it extracted environment variables and system information, including details about mounts, temporary directories and configurations.

The package then sent information including environment variables, the current working directory and hostname to an external webhook.

Later Versions Shifted Toward Twilio-Specific Targeting

Versions 1.0.1, 1.0.2 and 1.0.3 changed the package's behavior.

According to ReversingLabs, code in deamon.js searched for folders associated with Twilio Account SIDs.

Twilio uses these unique identifiers to identify resources such as accounts, messages and phone calls.

The package would avoid taking action if a specific SID-named folder was present. When matching target folders were found, however, it scanned installed npm packages and node_modules.

The researchers said the package then attempted to inject a custom proof-of-concept package by creating package.json and index.js files.

This behavior represented a shift from broad environment collection toward activity specifically associated with developers using Twilio APIs.

Version 1.0.4 Attempted to Exfiltrate Twilio Credentials

The campaign became more directly concerning with version 1.0.4.

ReversingLabs found functionality designed to obtain:

process.env.ACCOUNT_SID
process.env.AUTH_TOKEN

The values were then sent to an external webhook.

These variables correspond to credentials used by applications to authenticate with Twilio APIs.

The later versions did not maintain a single consistent development path.

Versions 1.0.8, 1.1.0 and 1.1.1 reverted toward the basic probing behavior seen in version 1.0.0.

ReversingLabs also found OSINT-oriented behavior in the final versions. The packages probed Twilio-related hosts, including:

• support-api.us1.twilio.com

• kafka-ui.au1.twilio.com

• litellm.ai-services.corp.twilio.com

One version also retrieved AWS instance metadata from:

169.254.169.254/latest/meta-data/

ReversingLabs said this metadata was not subsequently used or exfiltrated.

Was It Really a Twilio Bug Bounty Tool?

The package attempted to establish legitimacy by referencing Twilio's bug bounty program hosted through HackerOne.

ReversingLabs said the program itself is legitimate and includes protections for authorized security researchers.

However, the researchers found several inconsistencies between the malicious packages and Twilio's stated program requirements.

According to ReversingLabs, Twilio's bug bounty rules prohibit publicly exposing sensitive information and prohibit exfiltration of customer or employee data. The program also specifies requirements for researcher accounts and package naming.

The discovered package did not follow those requirements.

The package was named tw-pkgprobe-7731, rather than following the naming convention described by Twilio. It was also published under an unrelated npm account, twdepprobe7731.

ReversingLabs therefore concluded that the bug bounty explanation did not fit the observed behavior and that the packages showed signs of malicious intent.

After ReversingLabs notified npm, the packages were removed approximately one hour later.

The Campaign Was Not Highly Sophisticated

ReversingLabs said the campaign was less sophisticated than several other npm threats it has investigated.

The researchers found no clear identity or consistent purpose across the package versions.

The campaign also lacked several techniques commonly used to make malicious packages appear legitimate or hide their behavior.

ReversingLabs said it did not observe:

• Code obfuscation

• Typosquatting

• A convincing npm publishing identity

• Strong efforts to conceal the malicious functionality

The company contrasted the campaign with more sophisticated supply chain attacks that have used fabricated GitHub activity, malicious second stages and other techniques to establish credibility.

This distinction matters because malicious package campaigns do not necessarily require sophisticated tooling to create risk. A package that looks like a legitimate developer utility can still become a supply chain threat if developers install it without validating its origin and behavior.

What Developers Can Learn From the Campaign

The incident reinforces several practical software supply chain security considerations.

Verify the Package and Publisher

Package names can suggest an association with a company or security program without establishing that relationship.

Developers should verify the package publisher, official documentation and expected naming conventions before adding security or infrastructure-related packages to a project.

Treat Environment Variables as Sensitive

The campaign specifically targeted:

ACCOUNT_SID
AUTH_TOKEN

Developers should avoid exposing sensitive credentials in source code, logs or package environments where unnecessary.

Credential exposure can have consequences beyond the compromised development machine, particularly when the credentials provide access to external APIs.

Review Package Behavior

A package described as a security scanner or research tool should still be evaluated for what it actually does.

Unexpected access to environment variables, local files, installed dependencies, network endpoints or cloud metadata can warrant further investigation.

Secure the CI/CD Pipeline

ReversingLabs emphasized that maintaining a secure CI/CD environment and ensuring dependencies are free of malware are essential parts of protecting software projects.

Software supply chain security needs to extend beyond application code to the third-party packages incorporated during development and build processes.

Monitor Dependencies

ReversingLabs also points developers toward its free Spectra Assure Community service for searching open source packages for potential security issues, vulnerabilities and hidden malware.

Additional tools and controls may be appropriate depending on an organization's development environment and supply chain risk model.

Indicators of Compromise

ReversingLabs published hashes for the identified package versions as part of its investigation.

These indicators come from ReversingLabs' investigation. Developers and security teams investigating possible exposure should use the original IoC records and their own incident-response procedures when validating systems.

The Broader Software Supply Chain Risk

The Twilio-focused campaign is relatively narrow compared with some of the larger npm supply chain incidents tracked by ReversingLabs.

Its significance comes from the way the package attempted to blend into a legitimate developer workflow.

Security tools, API integrations and research utilities can appear trustworthy because their stated purpose sounds defensive. That makes provenance, publisher identity and package behavior important parts of dependency review.

The campaign also demonstrates why package security cannot be treated as a one-time check.

Malicious packages can change behavior between versions. In this case, ReversingLabs observed substantial differences across the 11 published versions, including credential targeting, environment discovery and Twilio-related reconnaissance.

The announcement highlights a broader industry shift toward treating open source dependencies as part of the security boundary rather than simply as development components.

For development teams, that means dependency management, CI/CD security, credential protection and package analysis all play a role in reducing software supply chain risk.

The identified tw-pkgprobe-7731 packages have been removed from npm, but the underlying lesson extends beyond this individual campaign: developers should not assume that a package's name, description or apparent security purpose establishes its legitimacy.