Malicious npm Package Steals Credentials via Fake Twilio Tool

Researchers have uncovered a malicious npm package named ’tw-pkgprobe-7731’ masquerading as a security tool for Twilio integrations. The package is designed to harvest sensitive credentials from developers and was published to the official registry in August.