This is a classic supply chain attack targeting the npm ecosystem, specifically weaponizing trust in a bug-bounty program to phish credentials from developers.
The package tw-pkgprobe-7731 (publisher: twdepprobe7731) was uploaded in mid-August 2026. It claims to be a legitimate probe tool for Twilio's bug-bounty program, but its actual function is credential exfiltration.
Technical Breakdown: – Tactic: Supply Chain Compromise (MITRE T1195) / User Execution (T1204) – Technique: Masquerading as a legitimate security tool to lower victim suspicion. – Payload: The package contains logic to harvest environment variables, .env files, and other credential stores commonly used by developers integrating Twilio APIs. – Exfiltration: Data is sent to an external endpoint controlled by the attacker (specific C2 IPs/hashes not disclosed in the summary, but standard practice is to monitor outbound connections to unknown domains on install). – Affected Ecosystem: npm registry; targets Node.js developers working with Twilio.
Defense: – Immediate Action: Check your package-lock.json or yarn.lock for any dependency on tw-pkgprobe-7731 or similar typo-squatted names. – Mitigation: Enforce strict package allowlisting in your CI/CD pipeline. Use tools like npm audit and Socket.dev to scan for suspicious behavior (e.g., post-install scripts, network calls) before dependency installation. – Detection: Monitor for unexpected outbound traffic from build servers or developer workstations during npm install operations.
Source: https://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.html
Source: r/SecOpsDaily · by /u/falconupkid