Malicious npm Package Disguised as Twilio Security Tool Steals Developer Credentials
Fake bug-bounty probe harvested Twilio API keys and system data before mysteriously reverting behavior
1Disguised as legitimate research tool
The malicious package 'tw-pkgprobe-7731' claimed to be an authorized Twilio bug-bounty research probe operating within Twilio's sandbox environment. It contained comments stating it only collected local process context without destructive actions. The package specifically targeted developers integrating Twilio services, checking for Twilio developer environments before executing its payload. Eleven versions were published rapidly within 45 minutes by the now-deleted 'twdepprobe7731' npm account.
2Multi-stage credential harvesting
Initial versions gathered system details like mounts, temporary folders, and configurations. Later versions specifically targeted Twilio account String Identifiers (SIDs), scanning node_modules to inject custom packages. Version 1.0.4 added capability to steal Twilio credentials (ACCOUNT_SID and AUTH_TOKEN), potentially allowing attackers to authorize billing and communications. The malware exfiltrated data via webhooks while maintaining the appearance of legitimate security research activity.
3Unusual version behavior shifts
The final three versions (1.0.8-1.1.1) unexpectedly reverted to basic probing functionality, dropping previous malicious features. The last two versions conducted OSINT gathering, probing Twilio-related hosts and fetching AWS metadata. This erratic version progression suggests unclear objectives, though researchers confirmed the packages violated Twilio's established security research guidelines on HackerOne.
4Lack of standard evasion tactics
Unlike typical supply chain attacks, this campaign showed minimal effort to conceal malicious intent. There was no code obfuscation, typosquatting, or attempts to make the publishing account appear legitimate. Researchers noted the absence of these common tactics suggests a less sophisticated threat actor. The packages' clear violation of Twilio's security research guidelines indicates definite malicious intent despite the benign facade.
5Targeted Twilio integration points
The malware specifically searched for folders containing Twilio SIDs, only activating when certain SID patterns were absent. It scanned installed npm packages to inject custom proof-of-concept packages, creating package.json and index.js files. This precise targeting suggests deep familiarity with Twilio development environments and common integration patterns used by developers working with the platform.
6Potential impact of stolen credentials
Compromised Twilio credentials (ACCOUNT_SID and AUTH_TOKEN) could allow attackers to authorize billing operations and trigger communications. Given Twilio's widespread use for SMS, voice, and other communication APIs, such access could enable large-scale spam operations or social engineering attacks. The credentials could also provide initial access for more extensive system compromises depending on how developers implement Twilio in their architectures.
7Security research guidelines violation
ReversingLabs confirmed the packages violated Twilio's bug hunting guidelines on HackerOne, confirming malicious intent. The campaign mixed seemingly benign features with malicious ones in certain releases but made no real effort to obscure harmful code. This contrasts with typical supply chain attacks that employ various deception techniques, suggesting either haste or inexperience from the threat actor.
8Developer environment security implications
This attack highlights risks in developer toolchains and package ecosystems. The case demonstrates how attackers can exploit trust in security research tools and platform-specific development patterns. It underscores the need for runtime identity controls and better governance over AI agents and automated systems accessing sensitive environments, especially as attackers increasingly use AI to accelerate reconnaissance and access escalation.