Threat Intelligence

Fake 'Twilio Bug Bounty' npm Package Caught Stealing Developer Credentials

The Hacker News · 23 Sept 2026

Key Takeaway Before installing any npm package, especially ones claiming to be security or bug-bounty tools, verify the publisher's legitimacy and review the code, since even trusted-sounding names can hide credential-stealing malware.

Researchers at ReversingLabs have uncovered a malicious npm package called 'tw-pkgprobe-7731' that pretended to be an authorised bug-bounty testing tool for Twilio's HackerOne program. Uploaded to the npm registry in mid-August 2026 by an account that has since disappeared, the package went through 11 versions published within a 45-minute window on the same day.

The package first checks whether it is running inside a Twilio developer environment before acting, exiting quietly if not. When the check passes, early versions collected system details such as environment variables, mounted drives and temporary folders, sending this data out through a webhook. Later versions became more targeted, searching for folders linked to specific Twilio account identifiers and, in one version, directly stealing Twilio account SID and auth token credentials, information that could let an attacker authorise billing or send messages on the victim's behalf. Some versions also attempted to inject malicious code into other npm packages on the system. The final three versions dropped this harmful behaviour and reverted to a basic, non-malicious probing function.

This case highlights how attackers are increasingly disguising malicious open-source packages as legitimate security tools to trick developers into installing them, particularly those integrating third-party services like Twilio.

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.