# Malicious npm package tw-pkgprobe-7731 targets developers integrating Twilio (credential harvesting)

> ReversingLabs identified the npm package tw-pkgprobe-7731, published by account twdepprobe7731 and posing as an authorized Twilio HackerOne bug-bounty probe. Across eleven versions published on 2026-08-14 it harvested environment variables and host data and, in some versions, exfiltrated Twilio ACCOUNT_SID/AUTH_TOKEN via a webhook and injected a package into node_modules. The package was removed from npm after ReversingLabs notified npm.

- **Published:** 2026-11-10T06:17:04Z
- **Last reviewed:** 2026-11-10T06:17:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5616
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5616.png
- **ID:** TL-2026-5616
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** RESOLVED
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

tw-pkgprobe-7731 is an npm package unaffiliated with Twilio that claimed to be an authorized security-research probe operating under Twilio's HackerOne bug-bounty program. ReversingLabs (researcher Lucija Valentic) reports that eleven versions (1.0.0-1.0.8, 1.1.0, 1.1.1) were published back to back on 2026-08-14 from the npm account twdepprobe7731. The activity does not comply with Twilio's bug-bounty rules: the package name did not follow the twilio-hackerone-poc-<random-string> convention and it was not published from an @wearehackerone.com identity, so the bug-bounty claim was judged false.

Version 1.0.0 checks whether it is running in a Twilio developer environment and exits if not. Otherwise it collects environment variables, mounts, temp folders and configuration, the current working directory and the hostname, and sends them to a webhook (the webhook destination is not disclosed in public reporting). Versions 1.0.1-1.0.3 add a deamon.js component that searches for folders named after Twilio Account SIDs (34-character resource identifiers); when target folders are found it scans installed npm packages and node_modules and writes a package.json and index.js to inject a custom proof-of-concept package. Version 1.0.4 adds exfiltration of process.env.ACCOUNT_SID and process.env.AUTH_TOKEN over the webhook, which would let a holder make Twilio API requests on the victim account (billing abuse, messaging/calls). Versions 1.0.5-1.0.7 are not individually described. Version 1.0.8 reverts to the basic probing profile of 1.0.0 and drops the malicious activity. Versions 1.1.0 and 1.1.1 perform final-phase OSINT probing of Twilio-related hosts (support-api.us1.twilio.com, kafka-ui.au1.twilio.com, litellm.ai-services.corp.twilio.com) and request AWS instance metadata at 169.254.169.254/latest/meta-data/; the metadata was fetched but not reportedly used or exfiltrated.

OSV (MAL-2026-14062, reported by Amazon Inspector) additionally describes the install scripts as checking for a Twilio Serverless build path, launching a hidden background process, and injecting code into other tenants' build directories. ReversingLabs assesses the actor as less sophisticated: no obfuscation, no typosquatting, no effort to make the npm account look legitimate; the end goal is unclear. Twilio stated it had no security incident and that the packages were removed from npm. No named threat actor, CVE or CVSS applies.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1552.005 Unsecured Credentials: Cloud Instance Metadata API
- T1082 System Information Discovery
- T1005 Data from Local System
- T1567.004 Exfiltration Over Web Service: Exfiltration Over Webhook

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Malicious npm Package tw-pkgprobe-7731 Install/Execution — Exploitation (Splunk SPL)** (`TL-2026-5616-SPL-001`)

Detects installation or execution of the malicious npm package tw-pkgprobe-7731 (MAL-2026-14062), published by twdepprobe7731 as a fake Twilio HackerOne probe, and node processes launching its deamon.js component. Supply-chain initial access on developer and CI hosts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1195.001, T1059.007, T1585
- **Data sources:** sysmon, defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (CommandLine="*tw-pkgprobe-7731*" OR ParentCommandLine="*tw-pkgprobe-7731*" OR CommandLine="*twdepprobe7731*" OR (Image="*\\node.exe" CommandLine="*deamon.js*" CommandLine="*node_modules*"))
| eval matched_ioc=case(like(CommandLine,"%tw-pkgprobe-7731%") OR like(ParentCommandLine,"%tw-pkgprobe-7731%"),"npm_package_tw-pkgprobe-7731", like(CommandLine,"%twdepprobe7731%"),"publisher_twdepprobe7731", true(),"node_deamon_js")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images by host, User, Image, matched_ioc
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User Image matched_ioc command_lines parent_images count
```

### Microsoft KQL

```kql
let pkg = "tw-pkgprobe-7731";
let ioc_sha1 = dynamic(["ea40177789e7a1b972c27c61dffff195dd85c544", "3fb29cf1ef3ce6b187e724c8e7dc4b6a5dfefa50", "7108c1079ac0de030902b049770e8cb822e82055", "985c294988e80f17414fb371b690080ee57387ea", "35b21553837b74e1fc5ac43efd839cdc28109fdf", "19c886b57a0c86e1efc82f4c4f2691f3ddc9f92c", "fbc422912fa5af59ba278b30d8c1707e0fd1711b", "fe4b42d7cf37ef2137fe5259626d51cb9922309e", "d11da34ecdc3ff768fbe79a0aaf12f2340c2dd90", "16574bd0538e6ae0ad4b7c73cd85c1232478f57d", "c87db83ee84ae03b97b3cb11b07ad75a6c2a39ae"]);
union
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where ProcessCommandLine has pkg or InitiatingProcessCommandLine has pkg or ProcessCommandLine has "twdepprobe7731"
 | project Timestamp, DeviceName, AccountName, Source = "process", Detail = ProcessCommandLine, Parent = InitiatingProcessCommandLine),
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FolderPath has pkg or SHA1 in (ioc_sha1)
 | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Source = "file", Detail = FolderPath, Parent = InitiatingProcessCommandLine)
| order by Timestamp desc
```

### Sigma

```yaml
title: Malicious npm Package tw-pkgprobe-7731 Install or Execution
id: 5616a001-0001-4a7e-9c11-5616a0000101
status: experimental
description: Detects process creation referencing the malicious npm package tw-pkgprobe-7731 (MAL-2026-14062) or its publisher account twdepprobe7731.
references:
    - https://www.reversinglabs.com/blog/malicious-npm-campaign-twilio
    - https://osv.dev/vulnerability/MAL-2026-14062
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.t1195.002
    - attack.resource-development
    - attack.t1585
    - attack.execution
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd:
        CommandLine|contains:
            - 'tw-pkgprobe-7731'
            - 'twdepprobe7731'
    selection_parent:
        ParentCommandLine|contains: 'tw-pkgprobe-7731'
    condition: 1 of selection_*
fields:
    - CommandLine
    - ParentCommandLine
    - Image
    - User
falsepositives:
    - Security teams deliberately analysing or blocklisting the package
    - Dependency scanners that print the package name on the command line
level: high

```

**Known false positives:**

- Security teams analysing or blocklisting tw-pkgprobe-7731 on the command line
- Dependency scanners that print package names in process arguments

**Tuning notes:** Scope to developer workstations and CI runners; add lockfile/registry proxy logs for hosts without process telemetry. The package is removed from npm, so hits are mostly historical installs from caches or mirrors.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Malicious npm Package [indicator] Install/Execution — Exploitation (Sentinel KQL) (locked: unlock with TL Creds)
- [indicator] [indicator] node_modules Package Injection — Post-Exploitation (Sentinel KQL) (locked: unlock with TL Creds)
- Node.js Contacting AWS IMDS, Twilio Probe Hosts or Webhook Services — C2 / Exfiltration (Sentinel KQL) (locked: unlock with TL Creds)
- Malicious npm Package [indicator] Install/Execution — Exploitation (Sigma) (locked: unlock with TL Creds)
- [indicator] [indicator] node_modules Package Injection — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- Node.js Contacting AWS IMDS, Twilio Probe Hosts or Webhook Services — C2 / Exfiltration (Sigma) (locked: unlock with TL Creds)
- [indicator] [indicator] node_modules Package Injection — Post-Exploitation (Splunk SPL) (locked: unlock with TL Creds)
- Node.js Contacting AWS IMDS, Twilio Probe Hosts or Webhook Services — C2 / Exfiltration (Splunk SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `support-api[.]us1[.]twilio[.]com`
- File hash: `ea40177789e7a1b972c27c61dffff195dd85c544`
- Domain: `kafka-ui[.]au1[.]twilio[.]com`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malicious npm campaign targets developers integrating Twilio](https://www.reversinglabs.com/blog/malicious-npm-campaign-twilio)
- [Malicious npm Package Poses as Twilio (The Hacker News)](https://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.html)
- [OSV MAL-2026-14062: Malicious code in tw-pkgprobe-7731 (npm)](https://osv.dev/vulnerability/MAL-2026-14062)
- [Spectra Assure: tw-pkgprobe-7731 malware analysis](https://secure.software/npm/packages/tw-pkgprobe-7731/malware)
- [SC World: Malicious npm package targets Twilio developers with data harvesting attempts](https://www.scworld.com/brief/malicious-npm-package-targets-twilio-developers-with-data-harvesting-attempts)
- [Daily Security Review: Malicious npm Package Impersonates Twilio Security Probe Tool](https://dailysecurityreview.com/cyber-security/malicious-npm-package-impersonates-twilio-security-probe-tool/)
- [Vulert: Malicious code in tw-pkgprobe-7731 (npm)](https://vulert.com/vuln-db/malicious-code-in-tw-pkgprobe-7731--npm-)
- [Twilio HackerOne bug-bounty program](https://hackerone.com/twilio)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5616