Poisoned Pipeline / Incidents / AS38
tw-pkgprobe-7731 npm campaign targeted Twilio developers
ReversingLabs found tw-pkgprobe-7731, an npm package with no Twilio
affiliation, published in 11 versions on 14 August 2026 from account
twdepprobe7731. Comments called it an authorized Twilio HackerOne
probe that ran only in Twilio's serverless packager sandbox. Version
1.0.0 exited unless it detected a Twilio developer environment, then
sent environment variables, mounts, temp folders, cwd, and hostname
over a webhook. Versions 1.0.1–1.0.3 looked for folders named after
34-character Twilio SIDs and, on a match, injected a PoC package into
node_modules. Version 1.0.4 added ACCOUNT_SID and AUTH_TOKEN
exfiltration. Later versions dropped that payload; the last two
probed Twilio-related hosts and fetched AWS IMDS metadata without
using it. The name and publisher did not match Twilio's HackerOne
PoC rules. npm removed the package about an hour after publication.
RL judged the operator unsophisticated (no obfuscation, no
typosquat, no attempt to look like a real maintainer).
Mapped techniques
- T0108 Accounts in public registry
- T0109 Publish malicious artifact
- T0159 Malicious artifact execution
- T0140 Harvest tokens from environment variables
- T0193 Sensitive information in environment variables
- T0156 Exfiltration over webhooks
supply-chain Malicious npm package posing as Twilio research
npm account twdepprobe7731 published the cluster; not a Twilio account.
Eleven versions of tw-pkgprobe-7731 in about 45 minutes on 14 Aug.
Ran after install; 1.0.0 gated on a Twilio developer environment.
1.0.4 sent process.env.ACCOUNT_SID and AUTH_TOKEN out over the webhook.
1.0.0 collected env vars plus mounts, temp dirs, cwd, and hostname.
Host context and Twilio API credentials were posted to a webhook.
Framework gaps noted
- Claiming HackerOne authorization inside package comments is not a named technique.
- Injecting a PoC package into local node_modules on SID-named folders is not a named technique.
- The AWS IMDS fetch in a late version was unused; not mapped as credential theft.