Full Report
The package poses as a security tool targeting developers looking to implement Internet-based apps with telecom networks.
Analysis Summary
# Incident Report: Malicious npm Campaign Targeting Twilio Developers
## Executive Summary
ReversingLabs identified a malicious npm campaign in August 2026 involving the package `tw-pkgprobe-7731`. The package impersonated a legitimate security research tool for Twilio integrations but was designed to exfiltrate sensitive developer credentials, including Twilio Account SIDs and Auth Tokens. The package has since been removed from the npm registry.
## Incident Details
- **Discovery Date:** August 2026
- **Incident Date:** August 2026 (Multiple versions uploaded)
- **Affected Organization:** Developers using Twilio APIs
- **Sector:** Software Development / Telecommunications
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 2026
- **Vector:** Typosquatting/Social Engineering (Supply Chain Attack)
- **Details:** The attacker published multiple versions of a malicious package named `tw-pkgprobe-7731` to the npm registry, posing as an authorized security tool for Twilio.
### Lateral Movement
- **N/A:** The primary goal was credential harvesting from the local development environment rather than lateral movement within a network.
### Data Exfiltration/Impact
- **Details:** The package targeted environmental variables and configuration files to steal `ACCOUNT_SID` and `AUTH_TOKEN`. These credentials allow attackers to authorize billing, trigger communications (SMS/Calls), and access identity verification services.
### Detection & Response
- **Discovery:** Identified by ReversingLabs (RL) during routine scanning of public repositories.
- **Response Actions:** The package was reported to npm and subsequently removed from the registry.
## Attack Methodology
- **Initial Access:** Supply Chain Contamination (malicious npm package).
- **Persistence:** Relies on the package being integrated into a developer's project or CI/CD pipeline.
- **Privilege Escalation:** N/A (Runs with the permissions of the user installing the package).
- **Defense Evasion:** Posing as a legitimate security tool to lower developer suspicion.
- **Credential Access:** Automated harvesting of Twilio API credentials (`ACCOUNT_SID`, `AUTH_TOKEN`) from the host environment.
- **Discovery:** Scans for specific Twilio-related environment variables.
- **Lateral Movement:** N/A.
- **Collection:** Gathering sensitive environment variables.
- **Exfiltration:** Sending harvested credentials to an attacker-controlled endpoint.
- **Impact:** Financial loss via API abuse and compromise of communication integrity (e.g., intercepting OTPs).
## Impact Assessment
- **Financial:** High potential for unauthorized billing charges on Twilio accounts.
- **Data Breach:** Exposure of API credentials and potentially sensitive communication logs.
- **Operational:** Disruption of SMS/Voice services if accounts are suspended for fraud.
- **Reputational:** Risk to developers whose applications might be used to send spam or phishing messages via compromised Twilio accounts.
## Indicators of Compromise
- **File Indicators (SHA-1):**
- `16574bd0538e6ae0ad4b7c73cd85c1232478f57d`
- `c87db83ee84ae03b97b3cb11b07ad75a6c2a39ae`
- `d11da34ecdc3ff768fbe79a0aaf12f2340c2dd90`
- **Behavioral Indicators:**
- npm package executing scripts to access `process.env` for Twilio-specific keys.
- Outbound network requests to unknown endpoints during package installation or execution.
## Response Actions
- **Containment:** Npm removed the malicious `tw-pkgprobe-7731` package.
- **Eradication:** Developers who installed the package must rotate their Twilio `AUTH_TOKEN` immediately.
- **Recovery:** Review Twilio account logs for unauthorized activity or unexpected billing spikes.
## Lessons Learned
- **Credential Safety:** Developers often overlook the security of API keys in development environments.
- **Trust Maturity:** Even packages labeled as "security tools" must be verified before use.
- **Registry Trends:** The volume of malicious npm packages is increasing annually, outpacing previous years' records.
## Recommendations
- **Rotate Credentials:** Immediately cycle any Twilio keys that were exposed in environments where the package was present.
- **Use Secret Management:** Avoid storing API keys in plain text environment variables; use dedicated secret management tools.
- **Package Verification:** Implement automated software composition analysis (SCA) to flag suspicious packages or new/unknown maintainers.
- **Principle of Least Privilege:** Use restricted API keys that only have the permissions necessary for the specific task at hand.