Malicious NPM Package Harvests Twilio Credentials

Cybersecurity researchers disclosed details of a malicious npm package named tw-pkgprobe-7731 that masquerades as a Twilio bug‑bounty probe while stealthily harvesting sensitive data. It was first uploaded to the npm registry in mid‑August 2026 by an npm account called twdepprobe7731¹.

The package presents itself as a legitimate tool for verifying Twilio credentials and endpoints. Once installed, it logs environment variables and transmits them to a remote server controlled by the attacker, allowing exfiltration without any user interaction beyond adding what appears to be a harmless dependency.¹

Attackers often exploit trust relationships between developers and third‑party libraries on NPM—a common practice because many modern applications rely heavily upon open‑source dependencies. The package uses techniques similar to the Log4j vulnerability, tricking devs into thinking they run legitimate tools while secretly logging information such as API keys; automated dependency scanning that flags suspicious packages prior to installation is recommended.¹

Check Point warned of a management server zero‑day exploited in targeted attacks on July 23. Vulnerability CVE‑2026‑93616 allows an attacker who can access the server’s web service to run scripts without logging in. A fix was released September 22. Earlier backdoors enabled by default due to insecure configuration practices were found as early as 2015 (CVE‑2015–7483). Attackers could potentially execute scripts and pivot into other network segments if proper segmentation isn’t enforced—a common attack vector given most organizations use centralized management systems across their infrastructure footprint and often lack sufficient isolation controls¹.

WordPress issued a patch for a critical flaw that can enable code execution on some servers. The flaw involves theme bloat where themes include unnecessary files or plugins from third parties without adequate security reviews before deployment onto production environments worldwide. The fix shipped September 22 in WordPress 7.1.2 with fixes for every branch still supported back to 4.7. This flaw resembles CVE‑2020‑5907, where unauthenticated users could upload arbitrary PHP files using specially crafted parameters. The fix limits file uploads within theme directories preventing unauthorized modifications or execution of external scripts, emphasizing thorough testing before deployment remains crucial today¹.

The malicious npm package incident underscores the importance of rigorous dependency management. Developers should employ automated scanning tools that flag packages with suspicious upload dates, unusual account names, or anomalous network activity. Maintaining a strict policy of only installing dependencies from well‑known sources and regularly auditing installed modules can mitigate similar attacks in the future.¹