Malicious npm Package Poses as Twilio BugBounty Probe Can Exfiltrate Credentials

Cybersecurity researchers have disclosed details of a malicious npm package named twpkgprobe7731 that masquerades as a security tool targeting developers integrating Twilio into their applications while stealthily attempting to harvest sensitive data The package named twpkgprobe7731 was first uploaded to the npm registry in midAugust 2026 by an npm account named twdepprobe7731