ReversingLabs (report covered 22 September 2026) details the malicious npm package tw-pkgprobe-7731 (publisher twdepprobe7731; 11 different versions published back to back on 14 August 2026; account later removed). Early versions claimed to be an “Authorized bug-bounty research probe (Twilio HackerOne program)” running only in Twilio’s serverless packager sandbox; behaviour instead fingerprints Twilio developer environments, exfiltrates host/process context and environment variables via webhook, later versions specifically target Twilio ACCOUNT_SID/AUTH_TOKEN and inject into node_modules, and some builds probe Twilio-related hosts plus AWS instance metadata.

Not affiliated with Twilio; RL assesses it almost certainly violates Twilio HackerOne rules of engagement (no customer/employee data exfiltration).

Package no longer present under that publisher as of RL write-up. (source: ReversingLabs blog)

Correction (24 Oct 2026): an earlier version said the 11 versions were published over about 45 minutes; ReversingLabs does not give that figure.

ReversingLabs says they were published back to back on 14 August. (source: ReversingLabs)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ReversingLabs)