Malicious npm Package 'tw-pkgprobe-7731' Poses as Twilio Bug-Bounty Tool — Detection and Remediation Guide

On September 2026, cybersecurity researchers disclosed a malicious npm package named tw-pkgprobe-7731 that impersonates a security research tool tied to Twilio's bug-bounty program. Uploaded in mid-August 2026 by the npm account twdepprobe7731, the package targets developers integrating Twilio SDKs into their applications — a population that, by definition, handles communications API credentials, auth tokens, and signing keys.

This is a classic dependency-confusion-adjacent social engineering play: publish a package whose name and description imply legitimacy ('probe,' 'security check,' 'bounty validation'), count on curious or security-conscious developers to install it, then execute payload logic during install or first import. The payload's objective is credential and environment exfiltration — precisely the data developers working with Twilio integrations have sitting in .env files, ~/.npmrc, shell histories, and CI variables.

If your developers use Twilio, or your CI/CD pipelines pull arbitrary npm packages, treat this as an active supply-chain threat. The package name pattern (vendor prefix + 'probe' + numeric suffix) is also a template we should expect to see reused against other vendors.

Technical Analysis

Threat Overview

• Package name: tw-pkgprobe-7731
• Publishing account: twdepprobe7731
• First published: Mid-August 2026
• Registry: npm (npmjs.com)
• Target population: Developers integrating Twilio (Programmable Messaging, Voice, Verify) into Node.js applications
• Objective: Harvesting sensitive data — environment variables, API credentials, npm tokens, and host metadata

Attack Chain (Defender's View)

The lure works because bug-bounty-themed packages carry a veneer of trust. A developer who sees a package claiming to 'probe' or 'validate' their Twilio integration for security issues may install it voluntarily — no exploit required. Typical execution flow for packages of this class:

1. Delivery: Developer runs npm install tw-pkgprobe-7731 (or the package is pulled transitively if listed as a dependency by another compromised package).
2. Execution trigger: Malicious logic fires via npm lifecycle hooks — most commonly a preinstall, install, or postinstall script defined in package.json. These run with the installing user's privileges, no user interaction needed beyond the install itself.
3. Collection: The payload reads high-value local artifacts: process.env (which in a running app or CI job includes injected secrets), .env files in the project tree, ~/.npmrc (contains //registry.npmjs.org/:_authToken=), SSH keys under ~/.ssh/, cloud credentials (~/.aws/credentials, ~/.azure/), and git config.
4. Exfiltration: Collected data is POSTed to an attacker-controlled endpoint — frequently disguised as telemetry, a webhook, or a requestbin/pipedream-style collector. Beaconing typically goes over HTTPS to blend with normal dev traffic.

Why Twilio Developers Are High-Value Targets

A stolen Twilio Account SID + Auth Token pair gives an attacker the ability to send SMS/voice at the victim's expense, intercept or manipulate OTP/2FA flows built on Twilio Verify, and access message logs containing customer PII. Combined with stolen npm publish tokens, the blast radius extends to every package the developer maintains — turning a single install into a downstream supply-chain compromise.

Exploitation Status

This is confirmed in-the-wild distribution via the public npm registry — not theoretical. There is no CVE assigned (registry-hosted malware is tracked by package name, not CVE). The package should be treated as live malware: any system where it was installed must be considered compromised, not merely 'at risk.'

Detection & Response

Sigma Rules

---
title: npm Install of Known Malicious Twilio-Themed Package
description: Detects installation or reference to the malicious npm package tw-pkgprobe-7731 or similarly patterned probe packages impersonating vendor security tools.
references:
  - https://thehackernews.com/2026/09/malicious-npm-package-poses-as-twilio.html
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
  selection_cli:
    CommandLine|contains:
      - 'tw-pkgprobe'
      - 'pkgprobe-'
      - 'depprobe'
  condition: selection_img and selection_cli
falsepositives:
  - None expected; these strings have no legitimate use
level: critical
---
title: npm Lifecycle Hook Spawning Shell or Script Interpreter
description: Detects npm spawning shell interpreters during install, consistent with malicious preinstall/postinstall lifecycle scripts used by supply-chain malware to harvest credentials.
references:
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate packages with native build steps (node-gyp) — tune with package allowlist and build-context correlation
level: high
---
title: Node Process Accessing Credential Stores
description: Detects node.exe or npm child processes reading npm tokens, SSH keys, cloud credentials, or .env files — a strong indicator of credential-harvesting supply-chain payloads.
references:
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
  selection_target:
    TargetFilename|contains:
      - '\.npmrc'
      - '\.ssh\'
      - '\.aws\credentials'
      - '\.azure\'
      - '\.env'
  condition: selection_img and selection_target
falsepositives:
  - Legitimate builds reading .env for configuration; correlate with recent unusual package installs
level: high

KQL — Microsoft Sentinel / Defender

This query hunts across process telemetry for installs of the malicious package, npm spawning shells, and node processes touching credential files. It works on Defender XDR tables and applies equally to Linux dev workstations ingested via the Defender for Endpoint agent or Syslog/CEF.

let SuspiciousPkgs = dynamic(["tw-pkgprobe-7731", "pkgprobe-", "depprobe"]);
let CredPaths = dynamic(["/.npmrc", "/.ssh/", "/.aws/credentials", "/.azure/", "/.env"]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any (SuspiciousPkgs)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FileName, InitiatingProcessFileName, Indicator="Malicious package reference"),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("npm", "npm.cmd", "node", "node.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "sh", "bash", "curl", "wget")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FileName, InitiatingProcessFileName, Indicator="npm/node spawning shell or downloader"),
(DeviceFileEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("node", "node.exe", "npm")
| where FolderPath has_any (CredPaths)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FolderPath, InitiatingProcessFileName, Indicator="Node process reading credential artifact")
| order by TimeGenerated desc

Velociraptor VQL

Use this hunt across developer workstations and build agents to surface package installs referencing the malicious name and node processes reaching into credential locations. Pair pslist() with a glob() sweep of node_modules for the package directory as forensic confirmation.

-- Hunt for malicious Twilio-probe npm package artifacts and node credential access
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)tw-pkgprobe|pkgprobe-|depprobe'
   OR (Name =~ '(?i)node|npm' AND CommandLine =~ '(?i)\.npmrc|\.ssh|\.aws/credentials|\.azure|\.env')

-- Sweep filesystems for installed copy of the malicious package in node_modules
SELECT FullPath, Mtime, Size
FROM glob(globs=['C:/Users/*/**/node_modules/tw-pkgprobe-7731/package.json',
                 '/home/*/**/node_modules/tw-pkgprobe-7731/package.json',
                 '/root/**/node_modules/tw-pkgprobe-7731/package.json'])

Remediation Script

Run this Bash script on Linux/macOS developer workstations and build agents to audit for the malicious package, flag suspicious lifecycle hooks, and enumerate exposed credential artifacts that require rotation.

#!/bin/bash
# tw-pkgprobe-7731 compromise audit — Security Arsenal IR
# Run on developer workstations and CI build agents. Review output before acting.

MAL_PKG="tw-pkgprobe-7731"
REPORT="npm-compromise-audit-$(hostname)-$(date +%Y%m%d).txt"

echo "=== [1] Installed copies of malicious package ===" | tee "$REPORT"
find / -type d -name "$MAL_PKG" -path "*node_modules*" 2>/dev/null | tee -a "$REPORT"

echo "=== [2] Lockfile references ===" | tee -a "$REPORT"
grep -rls "$MAL_PKG\|pkgprobe-\|depprobe" \
  --include="package-lock.json" --include="yarn.lock" --include="pnpm-lock.yaml" \
  /home /root /opt /srv 2>/dev/null | tee -a "$REPORT"

echo "=== [3] npm global list ===" | tee -a "$REPORT"
npm ls -g --depth=0 2>/dev/null | grep -i "probe" | tee -a "$REPORT"

echo "=== [4] Packages with install lifecycle hooks (review manually) ===" | tee -a "$REPORT"
find /home /root -name package.json -path "*node_modules*" 2>/dev/null \
  -exec grep -l '"preinstall"\|"postinstall"\|"install"' {} \; | head -50 | tee -a "$REPORT"

echo "=== [5] Credential artifacts present (ROTATE if package found) ===" | tee -a "$REPORT"
for f in "$HOME/.npmrc" "$HOME/.aws/credentials" "$HOME/.ssh/id_rsa" "$HOME/.ssh/id_ed25519"; do
  [ -f "$f" ] && echo "EXPOSED: $f" | tee -a "$REPORT"
done

echo "=== [6] Recent outbound connections from node processes ===" | tee -a "$REPORT"
ss -tunap 2>/dev/null | grep -i node | tee -a "$REPORT"

echo "Audit complete: $REPORT"
echo "If any hits in [1]-[3]: treat host as compromised. Rotate ALL credentials reachable from this machine."

Remediation

1. Remove the package immediately. If tw-pkgprobe-7731 (or anything matching the pkgprobe/depprobe naming pattern) appears in node_modules, lockfiles, or global installs, remove it — but understand removal is not remediation. The payload likely already executed.
2. Rotate every credential reachable from affected hosts. This includes npm publish tokens (npm token revoke / regenerate at npmjs.com), Twilio Account SID/Auth Token pairs (rotate in the Twilio Console under API Keys & Credentials), cloud provider keys, SSH keys, and any secrets present in .env files or environment variables on the machine. Assume full compromise.
3. Audit downstream blast radius. If a compromised developer holds publish rights to internal or public npm packages, review recent publishes for tampering. Check Twilio logs for unauthorized API usage (messages sent, Verify traffic spikes) since mid-August 2026.
4. Hunt your CI/CD pipeline. Build agents are prime targets — they hold signing keys and deployment credentials. Search pipeline logs and artifact caches for the package name. Ephemeral runners limit persistence but not credential theft.
5. Enforce install-time controls going forward:
   • Set ignore-scripts=true in .npmrc for CI environments to neutralize lifecycle-hook payloads, with explicit exceptions for vetted native modules.
   • Pin dependencies with lockfiles and enforce integrity hashes (npm ci instead of npm install in pipelines).
   • Deploy a private registry proxy (e.g., JFrog Artifactory, Sonatype Nexus, or a Socket/Phylum-style package firewall) that blocks packages younger than N days or matching typosquat/impersonation heuristics before they reach developers.
6. Brief your developers on the lure. The 'bug bounty probe' pretext is the attack. Any package claiming affiliation with a vendor's security program should be verified against the vendor's official channels before installation — Twilio does not distribute security tooling through random npm packages.
7. Report and track. Report impersonating packages to npm's security team (npmjs.com support) and monitor the vendor's security advisories. No CVE applies here; track by package name and publisher account (twdepprobe7731).

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub