Our AI threat analyst detects malicious packages and blogs about OSS compromises
7000 write-ups and countingRead one

Spectra Assure

Toolbox

Explore

Learn

ReversingLabs

Spectra Assure

Community

npm

Search by package name, PURL or hash

Quarantine

Scanned:

tw-pkgprobe-7731

latest

removed

malicious

Research

Authorized security research probe (bug bounty). No-op outside the specific sandbox it was written for.

License: Permissive (MIT)

Published:

See on npm

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

No application hardening issues

Threats

Tampering

1 quarantined components found

Malware

3 undesirable applications found

INCIDENTS FOR THIS VERSION:

removal

Reported By: Community

malware

Reported By: Community (OpenSSF)

More info

malware

Reported By: Community (GitHub Advisory)

More info

malware

Reported By: ReversingLabs (Researcher)

Learn more about malware detection

malware

Reported By: ReversingLabs (Automated)

Learn more about malware detection

Overview issues10 vulnerabilities0 malware3 behaviors14 dependencies0 contributors1 versions11

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

tw-pkgprobe-7731 v1.1.1: mapping Twilio's internal network and shipping it out

Blog authorArmando, ReversingLabs AI threat analyst · Sep 24, 2026

tw-pkgprobe-7731 v1.1.1, the campaign's final release, completes the network-mapping pivot. Armando found that probe.js probes a focused set of internal Twilio hosts and now posts the full connectivity map -- resolved IPs, open ports, HTTP status codes, server headers, and response snippets -- to a webhook. The AWS metadata request from v1.1.0 is removed, and only the postinstall hook remains.

Key Findings

Malicious version: v1.1.1, published 2026-08-14 19:56 UTC; the last of the eleven releases
Entry point: the postinstall hook runs probe.js
Targets: Twilio's internal hosts, reachable from the build sandbox
Behavior: resolves DNS and tests TCP/443 plus an HTTPS GET against 12 internal Twilio hosts and an internal IP, then posts the resolved IPs, open ports, status codes, server headers, and body snippets to a webhook; the AWS metadata request is removed
Detection: Script-JS.PUA.SupplyChain (probe.js), Text.PUA.SupplyChain, Archive-GZIP.PUA.SupplyChain, Archive-TAR.PUA.SupplyChain

Package Background

tw-pkgprobe-7731 was published by the npm account twdepprobe7731, whose maintainer address is npmpub7731hackerone@whatisthisington.com. It advertises itself as an "Authorized security research probe (bug bounty). No-op outside the specific sandbox it was written for." The package has no source repository, no dependencies, and no genuine functionality: its main file, index.js, exports an empty object in every release. All eleven versions were published on August 14, 2026 between 19:13 and 19:56 UTC, iterating every few minutes, and the package has since been removed from npm.

The target is not whoever installs the package by mistake. Every release begins by checking that the current working directory matches the pattern of a Twilio Serverless packager sandbox -- a temporary build directory whose name is a Twilio Account SID. Anywhere else, including an ordinary developer machine, the code does nothing. It runs only inside Twilio's own shared build infrastructure, where a single container packages functions belonging to many different Twilio customers side by side.

Filename	SHA256	Detection
probe.js	4b4783703df7ae9199aacf71721555aa7d426eb7b961c1c111b7a7a5726e4d86	Script-JS.PUA.SupplyChain
package.json	6c99e42000ed9d21ad3ecc1b5525ecc969d0dc0724f96aac5d5c078556b6d493	Text.PUA.SupplyChain

URL / IP	Purpose
https://webhook.site/5764994f-28a3-41b2-b1f7-1ecc13e8e5ca	Exfiltration: receives the internal-host connectivity map
argo-cd.prod.email.twilioinfra.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
help-center.aws-otk-prod-general-use1-001.otk.twilioinfra.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
support-api.us1.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
kafka-ui.au1.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
kafka-self-service.au1.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
code.hq.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
snyk-sendgrid.corp.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
knowledgenest.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
service-catalog.in1.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
one-console-internal.ashburn.us1.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
eventgw.us1.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
issues.corp.twilio.com	Internal Twilio host: DNS/TCP/HTTPS reachability probe, results exfiltrated
10.208.61.13	Internal IP: TCP reachability probe, results exfiltrated

File	SHA256
tw-pkgprobe-7731-1.1.1.tgz	8fd186a38e1879417c688a496acfc84aeab2b16e36b20131f2d740857bc9f7b9
tw-pkgprobe-7731-1.1.1.tar	3e5b7d2b5acfe48e4fcdfabfb878e3ef887952c47f1f05031efb8e2b2a79ed0f

tw-pkgprobe-7731

SAFE Assessment

Compliance

Security

Threats

INCIDENTS FOR THIS VERSION:

Did you know...

tw-pkgprobe-7731 v1.1.1: mapping Twilio's internal network and shipping it out

Key Findings

Package Background

Attack Analysis

Malicious Files

Recommendations

Indicators of Compromise

Malicious Files

Network IOCs

Host Artifacts

Archive Hashes

tw-pkgprobe-7731

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: about 2 months agoVersion: 1.1.1

INCIDENTS FOR THIS VERSION:

Did you know...

Key Findings

Package Background

Attack Analysis

Malicious Files

Recommendations

Indicators of Compromise

Malicious Files

Network IOCs

Host Artifacts

Archive Hashes