Malicious npm campaign targets developers integrating Twilio

ReversingLabs discovered a malicious npm package, tw-pkgprobe-7731, published in August that impersonated an authorized Twilio security probe; certain versions enumerated the environment, injected files into node_modules and exfiltrated Twilio ACCOUNT_SID and AUTH_TOKEN via webhook. The report documents version-by-version behavior, notes the packages were removed shortly after reporting, places the campaign in the context of rising registry malware and supply-chain compromises, and provides IoCs for detection and response.