Twilio says it has not been breached: a Twilio spokesperson told The Hacker News that 'Twilio has not experienced a security incident, and our systems and customer data remain secure and uncompromised' and that 'the npm packages have been removed.'

ReversingLabs (report covered 22 September 2026) details the malicious npm package tw-pkgprobe-7731 (publisher twdepprobe7731; 11 different versions published back to back on 14 August 2026; account later removed). Early versions claimed to be an “Authorized bug-bounty research probe (Twilio HackerOne program)” running only in Twilio’s serverless packager sandbox; behaviour instead fingerprints Twilio developer environments, exfiltrates host/process context and environment variables via webhook, later versions specifically target Twilio ACCOUNT_SID/AUTH_TOKEN and inject into node_modules, and some builds probe Twilio-related hosts plus AWS instance metadata.

Not affiliated with Twilio; RL assesses it almost certainly violates Twilio HackerOne rules of engagement (no customer/employee data exfiltration).

Package no longer present under that publisher as of RL write-up. Primary: ReversingLabs blog; wire: The Hacker News 22 Sep 2026.

Correction (24 Oct 2026): an earlier version said the 11 versions were published over about 45 minutes; neither ReversingLabs nor The Hacker News gives that figure.

ReversingLabs says they were published back to back on 14 August. (source: ReversingLabs)