Security1 publisher2 min readPublished
A fake Twilio bug-bounty probe went up on npm eleven times on August 14
ReversingLabs found tw-pkgprobe-7731 claiming to be an authorized Twilio HackerOne research probe while it tried to exfiltrate data, and its 2026 count of malicious npm packages passed all of 2024 by the end of August.
The Watch · Security desk
What happened
- ReversingLabs found an npm package in August that posed as an authorized security research tool for developers working with Twilio while attempting to exfiltrate sensitive data, and npm has since removed it.
- ReversingLabs counted 5,723 malicious npm packages by August 2026, passing the roughly 5,308 it logged for all of 2024 with four months of the year still to run.
- npm has announced plans for pre-publish scanning, which would screen packages for install-script abuse, unexplained tarball changes and credential harvesting before they become publicly installable.
- Packages kept getting through in the meantime, including a May 2026 campaign carrying the same payload as the most recent wave of Shai-Hulud, the worm family first seen in September 2025.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure A developer workstation with live Twilio credentials on it is the cheapest route into an account that can send messages, read OTP traffic and accrue charges, and the account holder pays the usage.
- decision Adding an integration dependency becomes a publisher identity check: whether the vendor named in the package is the party that published it.
- constraint Pre-publish scanning inspects package behaviour, so a clean-looking package that recruits developers through a borrowed brand name and a plausible authorization claim still needs a human to reject it at install time.
Twilio integrations run on two strings. Developers use ACCOUNT_SID and AUTH_TOKEN to reach the API, and those values authorize billing and trigger communication; Twilio's documentation tells developers to keep them secret, because anyone who has them can make an API request for the account [12]. If they leak, an attacker can send spam, steal OTPs, reach APIs without authorization and run up large API usage bills [13]. Twilio says it has internal systems that detect fraudulent use of its communications platform proactively and automatically, and it publishes an anti-fraud guide for developers [14].
tw-pkgprobe-7731 was aimed at developers who hold those values, and it claimed a permission it did not have. Comments in the first version describe it as an "Authorized bug-bounty research probe (Twilio HackerOne program)" that "runs only inside Twilio's serverless packager sandbox" and "collects local process/host context and writes it next to itself; no destructive action" [11]. ReversingLabs says the package had no affiliation with Twilio [8].
The publishing pattern was the first thing ReversingLabs flagged. Eleven versions of the single package went out back to back on August 14 [9], where a new npm release normally builds on the foundation set by earlier ones; RL called the difference the first of many red flags it found [10].
The registry-wide numbers sit behind it. RL logged 5,308 unique malicious npm packages for 2024, excluding spam [1], against 5,723 through August 2026 [2]. That is 415 more in eight months than in twelve [1]. Per month it works out at about 715 against 442, a factor of 1.6 [2]. Hold that pace and the year closes near 8,600 [3]. RL also says it has never seen more malicious packages published on public repositories [3].
Screening before publication acts on what a tarball does. The part that recruits a developer is the name and the comment block, and both of those invoked Twilio. Anyone who installed tw-pkgprobe-7731 between August 14 and the takedown has an AUTH_TOKEN to rotate.
What to watch
- Whether npm's announced pre-publish scanning actually ships, and whether monthly malicious publishing counts flatten after it does.
- Whether any Twilio account fraud, OTP interception or usage billing is traced back to a tw-pkgprobe-7731 install.
- Whether Shai-Hulud payloads start arriving in freshly published vendor-named integration packages instead of hijacked maintainer accounts.