Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials

Cybersecurity researchers have discovered a malicious npm package called tw-pkgprobe-7731 that pretends to be a security tool for developers using Twilio. This package is designed to collect sensitive information without being detected. It was uploaded to the npm registry in mid-August 2026 by an account named twdepprobe7731. The package targets developers who integrate Twilio into their applications. The malicious package's goal is to harvest sensitive data from these developers.