Malicious code in tw-pkgprobe-7731 (npm)
tw-pkgprobe-7731 is a malicious npm package that acts as an install-time dropper targeting Twilio Serverless environments. It exfiltrates Twilio account credentials and injects code into sibling build contexts to steal credentials from other tenants.
- Disclosed
- Last updated
- Blast radius
- Twilio Serverless deployments; any developer or CI/CD system installing tw-pkgprobe-7731
- Ecosystems
- Attack vectors
- Affected entities
- tw-pkgprobe-7731 · <UNKNOWN>
tw-pkgprobe-7731 is a malicious npm package discovered via Amazon Inspector and credited to the OpenSSF malicious-packages repository. The package contains obfuscated code that executes during preinstall/postinstall hooks.\n\nWhen installed in a Twilio Serverless build environment (detected by checking for /tmp/AC/ paths), the package drops a daemon process (/tmp/.npm-helper.js) that polls /tmp every 80ms for directories matching Twilio account SID patterns (AC followed by 32 hex characters). The daemon exfiltrates discovered account identifiers, service names, and package information to a hardcoded webhook.site endpoint (https://webhook.site/cc08d9d9-232a-42a2-8d55-0f75cb5e0e67).\n\nThe package also performs cross-tenant code injection by writing malicious modules into sibling build trees and appending attacker-authored code (marked /XTENANT_PROOF/) into runtime handlers, allowing it to capture ACCOUNT_SID and AUTH_TOKEN credentials from other tenants' execution contexts. The package.json falsely frames the package as an authorized Twilio HackerOne bug-bounty probe, but the actual behavior is credential theft and unauthorized code execution.\n\nThe advisory was published on 2026-08-15 via GitHub Security Advisory GHSA-449r-r4hm-3v9g.
Indicators of compromise
- Packages
- tw-pkgprobe-7731
- Domains
- webhook.site
Remediation
- Immediately remove tw-pkgprobe-7731 from all package.json files and lock files
- Audit npm install logs and CI/CD pipelines for any installations of tw-pkgprobe-7731
- Rotate all Twilio account credentials (ACCOUNT_SID and AUTH_TOKEN) that may have been exposed
- Scan /tmp directories on affected systems for .npm-helper.js or other suspicious daemon processes
- Review Twilio Serverless function logs for unauthorized code execution or unexpected API calls
- Implement npm package allow-listing or use private registries to prevent installation of untrusted packages
- Monitor webhook.site endpoint logs if accessible to determine scope of credential exfiltration
Sources
- GitHub Advisory GHSA-449r-r4hm-3v9g · GitHub Advisory Database
Cite this entry
"Malicious code in tw-pkgprobe-7731 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 15, 2026; last updated August 15, 2026. https://supplychainattack.org/incident/malicious-code-in-tw-pkgprobe-7731-npm-ii8qiy
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in svelte-dim-kit
The npm package svelte-dim-kit was found to contain malware, potentially giving attackers full control of affected systems. All systems with this package installed should be considered compromised and secrets/keys rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in stillm4ddpocs-rtest-bravo (npm)
The npm package stillm4ddpocs-rtest-bravo contained malicious code in its preinstall script that automatically executed during installation, collecting system information and internal package metadata and exfiltrating it to a third-party Interactsh collector via HTTPS and DNS tunneling.
npmCompromised package