Malicious npm package tw-pkgprobe-7731 targets developers integrating Twilio (credential harvesting)

Key facts

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5616 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Malicious npm Package tw-pkgprobe-7731 Install/Execution — Exploitation (Splunk SPL)

Detects installation or execution of the malicious npm package tw-pkgprobe-7731 (MAL-2026-14062), published by twdepprobe7731 as a fake Twilio HackerOne probe, and node processes launching its deamon.js component. Supply-chain initial access on developer and CI hosts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1195.001, T1059.007, T1585
• Data sources: sysmon, defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*tw-pkgprobe-7731*" OR ParentCommandLine="*tw-pkgprobe-7731*" OR CommandLine="*twdepprobe7731*" OR (Image="*\\node.exe" CommandLine="*deamon.js*" CommandLine="*node_modules*"))
| eval matched_ioc=case(like(CommandLine,"%tw-pkgprobe-7731%") OR like(ParentCommandLine,"%tw-pkgprobe-7731%"),"npm_package_tw-pkgprobe-7731", like(CommandLine,"%twdepprobe7731%"),"publisher_twdepprobe7731", true(),"node_deamon_js")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, Image, matched_ioc
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User Image matched_ioc command_lines parent_images count

Microsoft KQL

let pkg = "tw-pkgprobe-7731";
let ioc_sha1 = dynamic(["ea40177789e7a1b972c27c61dffff195dd85c544", "3fb29cf1ef3ce6b187e724c8e7dc4b6a5dfefa50", "7108c1079ac0de030902b049770e8cb822e82055", "985c294988e80f17414fb371b690080ee57387ea", "35b21553837b74e1fc5ac43efd839cdc28109fdf", "19c886b57a0c86e1efc82f4c4f2691f3ddc9f92c", "fbc422912fa5af59ba278b30d8c1707e0fd1711b", "fe4b42d7cf37ef2137fe5259626d51cb9922309e", "d11da34ecdc3ff768fbe79a0aaf12f2340c2dd90", "16574bd0538e6ae0ad4b7c73cd85c1232478f57d", "c87db83ee84ae03b97b3cb11b07ad75a6c2a39ae"]);
union
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where ProcessCommandLine has pkg or InitiatingProcessCommandLine has pkg or ProcessCommandLine has "twdepprobe7731"
 | project Timestamp, DeviceName, AccountName, Source = "process", Detail = ProcessCommandLine, Parent = InitiatingProcessCommandLine),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FolderPath has pkg or SHA1 in (ioc_sha1)
 | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Source = "file", Detail = FolderPath, Parent = InitiatingProcessCommandLine)
| order by Timestamp desc

Sigma

title: Malicious npm Package tw-pkgprobe-7731 Install or Execution
id: 5616a001-0001-4a7e-9c11-5616a0000101
status: experimental
description: Detects process creation referencing the malicious npm package tw-pkgprobe-7731 (MAL-2026-14062) or its publisher account twdepprobe7731.
references:
    - https://www.reversinglabs.com/blog/malicious-npm-campaign-twilio
    - https://osv.dev/vulnerability/MAL-2026-14062
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.t1195.002
    - attack.resource-development
    - attack.t1585
    - attack.execution
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd:
        CommandLine|contains:
            - 'tw-pkgprobe-7731'
            - 'twdepprobe7731'
    selection_parent:
        ParentCommandLine|contains: 'tw-pkgprobe-7731'
    condition: 1 of selection_*
fields:
    - CommandLine
    - ParentCommandLine
    - Image
    - User
falsepositives:
    - Security teams deliberately analysing or blocklisting the package
    - Dependency scanners that print the package name on the command line
level: high

Known false positives:

• Security teams analysing or blocklisting tw-pkgprobe-7731 on the command line
• Dependency scanners that print package names in process arguments

Tuning notes: Scope to developer workstations and CI runners; add lockfile/registry proxy logs for hosts without process telemetry. The package is removed from npm, so hits are mostly historical installs from caches or mirrors.

• 🔒 Malicious npm Package [indicator] Install/Execution — Exploitation (Sentinel KQL) · unlock with TL Creds
• 🔒 [indicator] [indicator] node_modules Package Injection — Post-Exploitation (Sentinel KQL) · unlock with TL Creds
• 🔒 Node.js Contacting AWS IMDS, Twilio Probe Hosts or Webhook Services — C2 / Exfiltration (Sentinel KQL) · unlock with TL Creds
• 🔒 Malicious npm Package [indicator] Install/Execution — Exploitation (Sigma) · unlock with TL Creds
• 🔒 [indicator] [indicator] node_modules Package Injection — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 Node.js Contacting AWS IMDS, Twilio Probe Hosts or Webhook Services — C2 / Exfiltration (Sigma) · unlock with TL Creds
• 🔒 [indicator] [indicator] node_modules Package Injection — Post-Exploitation (Splunk SPL) · unlock with TL Creds
• 🔒 Node.js Contacting AWS IMDS, Twilio Probe Hosts or Webhook Services — C2 / Exfiltration (Splunk SPL) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-5616.

Sample indicators (3 of 19)

• Domain: support-api[.]us1[.]twilio[.]com
• File hash: ea40177789e7a1b972c27c61dffff195dd85c544
• Domain: kafka-ui[.]au1[.]twilio[.]com

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

Technical analysis

The package was removed from npm after ReversingLabs notified npm.

tw-pkgprobe-7731 is an npm package unaffiliated with Twilio that claimed to be an authorized security-research probe operating under Twilio's HackerOne bug-bounty program. ReversingLabs (researcher Lucija Valentic) reports that eleven versions (1.0.0-1.0.8, 1.1.0, 1.1.1) were published back to back on 2026-08-14 from the npm account twdepprobe7731. The activity does not comply with Twilio's bug-bounty rules: the package name did not follow the twilio-hackerone-poc-<random-string> convention and it was not published from an @wearehackerone.com identity, so the bug-bounty claim was judged false.

Version 1.0.0 checks whether it is running in a Twilio developer environment and exits if not. Otherwise it collects environment variables, mounts, temp folders and configuration, the current working directory and the hostname, and sends them to a webhook (the webhook destination is not disclosed in public reporting). Versions 1.0.1-1.0.3 add a deamon.js component that searches for folders named after Twilio Account SIDs (34-character resource identifiers); when target folders are found it scans installed npm packages and node_modules and writes a package.json and index.js to inject a custom proof-of-concept package. Version 1.0.4 adds exfiltration of process.env.ACCOUNT_SID and process.env.AUTH_TOKEN over the webhook, which would let a holder make Twilio API requests on the victim account (billing abuse, messaging/calls). Versions 1.0.5-1.0.7 are not individually described. Version 1.0.8 reverts to the basic probing profile of 1.0.0 and drops the malicious activity. Versions 1.1.0 and 1.1.1 perform final-phase OSINT probing of Twilio-related hosts (support-api.us1.twilio.com, kafka-ui.au1.twilio.com, litellm.ai-services.corp.twilio.com) and request AWS instance metadata at 169.254.169.254/latest/meta-data/; the metadata was fetched but not reportedly used or exfiltrated.

OSV (MAL-2026-14062, reported by Amazon Inspector) additionally describes the install scripts as checking for a Twilio Serverless build path, launching a hidden background process, and injecting code into other tenants' build directories. ReversingLabs assesses the actor as less sophisticated: no obfuscation, no typosquatting, no effort to make the npm account look legitimate; the end goal is unclear. Twilio stated it had no security incident and that the packages were removed from npm. No named threat actor, CVE or CVSS applies.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Execution

T1059.007 Command and Scripting Interpreter: JavaScript

Discovery

T1082 System Information Discovery

Initial Access

T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Credential Access

T1552 Unsecured Credentials; T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Exfiltration

T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook

Resource Development

T1585 Establish Accounts

Remediation

Patches

• No vendor patch applies; the package was removed from the npm registry

Immediate actions

• Search package-lock.json, yarn.lock and node_modules for tw-pkgprobe-7731 in all repositories, CI runners and developer workstations
• Rotate Twilio ACCOUNT_SID/AUTH_TOKEN and any other secrets present in environments where the package was installed
• Audit Twilio account activity for unauthorized messaging, calls or billing anomalies
• Review application and CI logs for outbound webhook traffic and for unexpected package.json/index.js files inside node_modules

Workarounds

• Block installation of tw-pkgprobe-7731 via registry allow/deny lists
• Run npm install with --ignore-scripts in untrusted or build contexts

Longer-term hardening

• Use least-privilege Twilio API keys instead of the primary Auth Token
• Enforce lockfiles and dependency scanning in CI/CD and vet every package before install
• Review install scripts and third-party integrations; restrict secrets exposed to build environments

Affected and fixed versions

• npm (community package) — tw-pkgprobe-7731
  Vulnerable versions: 1.0.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7; 1.0.8; 1.1.0
  Fixed in: Removed from npm; no safe version exists
• Twilio — Twilio developer environments and accounts (ACCOUNT_SID / AUTH_TOKEN)
  Vulnerable versions: Environments where tw-pkgprobe-7731 was installed
  Fixed in: Twilio reported no security incident on its platform

Timeline

• 2026-08-14 ReversingLabs discovers the package and notifies npm; the package is removed about an hour after publication per ReversingLabs.
• 2026-08-14 Versions 1.1.0 and 1.1.1 probe Twilio-related hosts and request AWS instance metadata at 169.254.169.254; 1.0.8 had reverted to basic probing without malicious activity.
• 2026-08-14 Version 1.0.4 adds exfiltration of process.env.ACCOUNT_SID and process.env.AUTH_TOKEN over the webhook; 1.0.1-1.0.3 introduced locked-ioc-16 SID-folder search and node_modules package injection.
• 2026-08-14 Account twdepprobe7731 publishes eleven versions of tw-pkgprobe-7731 (1.0.0-1.0.8, 1.1.0, 1.1.1) back to back on npm, claiming to be an authorized Twilio HackerOne bug-bounty probe.
• 2026-08-15 OSV publishes MAL-2026-14062 (reported by Amazon Inspector) for malicious code in tw-pkgprobe-7731.
• 2026-09-22 ReversingLabs publishes its blog analysis 'Malicious npm campaign targets developers integrating Twilio'; The Hacker News covers it the same day.
• 2026-09-23 Coverage updated with Twilio's response: no security incident on its platform, packages removed from npm, recommends least-privilege keys, lockfiles and dependency scanning.

Sources cited

• OSV MAL-2026-14062: Malicious code in tw-pkgprobe-7731 (npm) osv.dev · Advisory · 2026-08-15
• Vulert: Malicious code in tw-pkgprobe-7731 (npm) vulert.com · Advisory · 2026-08-15
• Malicious npm campaign targets developers integrating Twilio reversinglabs.com · Research · 2026-09-22
• Spectra Assure: tw-pkgprobe-7731 malware analysis secure.software · Research · 2026-09-22
• Twilio HackerOne bug-bounty program hackerone.com · Vendor report · 2026-09-22
• Malicious npm Package Poses as Twilio (The Hacker News) The Hacker News · News · 2026-09-22
• SC World: Malicious npm package targets Twilio developers with data harvesting attempts scworld.com · News · 2026-09-23
• Daily Security Review: Malicious npm Package Impersonates Twilio Security Probe Tool dailysecurityreview.com · News · 2026-09-23

More in supply chain

• Microsoft Research 'Lazarus' Technique: Backdooring AI Agents by Editing Fewer Than 10 Model Neurons (Model Supply-Chain Risk)
• Malicious RubyGem strutil-core 1.0.1 Steals 51 Credential Types and Backdoors AI Coding Tools (testmetest / Miasma worm, Shai-Hulud descendant)
• Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 Supply-Chain Compromise Delivers Wallet-Stealing Malware and Backdoors
• Malicious @ethersphere/bee-js 13.3.0 npm Release and Swarm Desktop 0.56.2 Deliver SleepyDuck Ethereum C2 Backdoor
• GhostAction Supply Chain Campaign Expands: Malicious GitHub Actions Workflow Steals Cloud and AI Credentials from Tens of Thousands of Repositories

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages