Malicious npm Package Targeted Twilio Developers and Exfiltrated API Credentials
Summary
ReversingLabs found an npm package posing as a Twilio security probe that collected environment data and attempted to exfiltrate Twilio API credentials. npm removed the package after notification.
Key points
- The package tw-pkgprobe-7731 published 11 versions on August 14 and was not affiliated with Twilio.
- Early versions checked for Twilio developer environments and collected environment variables and system details, sending data to a webhook.
- Version 1.0.4 attempted to exfiltrate Twilio ACCOUNT_SID and AUTH_TOKEN credentials.
- Some versions searched for Twilio-related account folders and injected files into installed npm packages.
- Later versions probed Twilio-related hosts; one fetched AWS instance metadata but did not use or exfiltrate it.
- The package’s bug-bounty claims conflicted with Twilio’s program rules and naming requirements.
- ReversingLabs notified npm, and the packages were removed about an hour after publication.
Article Details
- Attack Vectors
- Malicious npm package tw-pkgprobe-7731 impersonated an authorized Twilio security research probe.
- The package extracted environment variables and system details from environments it identified as Twilio developer environments, then sent them via webhook.
- Versions 1.0.1–1.0.3 searched for Twilio-related folders and, when matching folders were found, injected a custom npm PoC package into installed npm packages and node_modules.
- Version 1.0.4 attempted to exfiltrate process.env.ACCOUNT_SID and process.env.AUTH_TOKEN over a webhook.
- The final two versions probed Twilio-related hosts and fetched AWS instance metadata; the article says the metadata was not used or exfiltrated.
- Defensive Notes
- Keep Twilio ACCOUNT_SID and AUTH_TOKEN secret; the article notes that possession of these credentials can enable API requests on the account.
- Secure CI/CD pipelines and verify that packages used in projects are clean and free of malware.
- Twilio's bug bounty guidance requires researchers not to expose sensitive information publicly or exfiltrate customer or employee data, and specifies account, test-asset, email, and package-naming requirements.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 3fb29cf1ef3ce6b187e724c8e7dc4b6a5dfefa50 | SHA1 hash listed for malicious npm package tw-pkgprobe-7731 version 1.0.1. |
| SHA1 | 7108c1079ac0de030902b049770e8cb822e82055 | SHA1 hash listed for malicious npm package tw-pkgprobe-7731 version 1.0.2. |
| SHA1 | ea40177789e7a1b972c27c61dffff195dd85c544 | SHA1 hash listed for malicious npm package tw-pkgprobe-7731 version 1.0.0. |
MITRE ATT&CK
T1082 · System Information DiscoveryThe package collected system details, including mounts, temporary folders, and configuration information.T1083 · File and Directory DiscoveryVersions 1.0.1–1.0.3 searched folders associated with Twilio account SIDs and scanned installed npm packages and node_modules.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign published a malicious package to the npm repository for developers to integrate into their environments.T1567.004 · Exfiltration Over WebhookThe package sent collected environment information and, in version 1.0.4, Twilio API credentials over a webhook.
Products
npmLooking at the metrics, npm saw around 5308 unique malicious packages published in 2024 (excluding spam).Spectra Assure CommunityRL’s free Spectra Assure Community site can help. It allows developers to search open-source packages used in their code to check for potential security issues, software vulnerabilities and hidden malware.Twiliodiscovered in August that poses as an authorized security research tool for developers working with Twilio, a widely used platform for powering communications for Internet-based applications, while attempting to