tw-pkgprobe-7731 npm Campaign Shifts Between Probing and Twilio SID Credential Theft Across 11 Versions
A low-sophistication actor published 11 versions of tw-pkgprobe-7731 in under an hour, toggling credential theft on and off while targeting Twilio serverless environments. Evidence from npm timestamps and code comments shows deliberate testing of detection rather than legitimate research. The campaign highlights persistent gaps in third-party library vetting for developers handling messaging credentials.
No additional versions have appeared since 1.1.1. Organizations should audit node_modules for any package referencing tw-pkgprobe or Twilio SID folder checks and rotate any exposed ACCOUNT_SID/AUTH_TOKEN pairs discovered in logs. Future campaigns are likely to reuse the same environment-gating technique against other serverless providers.
ReversingLabs: No new versions or related accounts targeting Twilio SIDs published within 45 days of 15 August 2026
Sources (2)
- [1]Primary Source(https://www.reversinglabs.com/blog/malicious-npm-tw-pkgprobe-7731)
- [2]Supporting Source(https://registry.npmjs.org/tw-pkgprobe-7731)