Loading story…
Cybersecurity researchers have identified a sophisticated phishing campaign, codenamed Beamglea, that leverages 175 malicious packages published on the npm registry to facilitate credential harvesting attacks. The campaign has targeted over 135 organizations across industrial, technology, and energy sectors worldwide. The malicious packages, which have been collectively downloaded more than 26,000 times, serve as infrastructure rather than directly infecting systems upon installation. Instead of executing malicious code during installation, these packages are designed to exploit npm’s public registry and the unpkg.com CDN to host and distribute redirect scripts. These scripts are embedded in HTML files that masquerade as legitimate documents such as purchase orders or technical specifications. When opened, the HTML files load JavaScript from the unpkg CDN, which then redirects victims to credential harvesting pages, often targeting Microsoft account credentials. The packages are programmatically generated using a Python script named 'redirect_generator.py', which creates packages with randomized names like 'redirect-xxxxxx', injects the victim’s email address, and a custom phishing URL. This automation allows the threat actors to rapidly scale their infrastructure and personalize attacks. The campaign was initially flagged by Paul McCarty at Safety in late September 2025, and further expanded upon by Socket’s Threat Research Team, who discovered additional packages and provided a comprehensive analysis. The download counts for these packages are believed to be inflated by automated scanners, security researchers, and CDN infrastructure, rather than widespread accidental installation by developers. The threat actors’ abuse of trusted infrastructure like npm and unpkg.com makes detection and mitigation more challenging, as these services are widely used and considered reputable within the software development community. At the time of reporting, most of the malicious packages remained live, prompting researchers to petition for their removal and the suspension of the associated threat actor accounts. The campaign’s use of randomized package names and the lack of direct malicious payloads in the packages themselves further complicate traditional detection methods. The operation’s codename, Beamglea, appears to be unique to this campaign, with no prior online presence, aiding in tracking and attribution. Researchers have identified over 630 HTML files associated with the campaign, each crafted to lure victims into providing sensitive credentials. The campaign highlights the growing trend of abusing open-source package registries and CDNs as free, scalable infrastructure for phishing operations. Security teams are advised to monitor for suspicious npm packages and scrutinize the use of unpkg.com-hosted scripts in their environments. The incident underscores the importance of supply chain vigilance and the need for enhanced monitoring of public code repositories for abuse.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting described the activity as the Beamglea campaign and said the attackers abused both the npm ecosystem and the unpkg CDN to support large-scale credential phishing operations. This added attribution and technical context to the previously disclosed package-based phishing activity.
Security researchers identified 175 malicious npm packages that were being used to host phishing infrastructure, with reporting indicating the campaign targeted more than 135 organizations. The packages were also reported to have accumulated roughly 26,000 downloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated spearphishing campaign has been uncovered targeting sales and commercial personnel at critical infrastructure-adjacent organizations, particularly in the United States and allied nations. Threat actors have weaponized the npm registry by publishing at least 27 malicious packages under multiple aliases, using them as a distribution layer for browser-based phishing components. These packages deliver client-side HTML and JavaScript lures that impersonate secure document-sharing workflows and Microsoft sign-in pages, with the intent to harvest credentials from targeted individuals in sectors such as manufacturing, industrial automation, plastics, and healthcare. The operation demonstrates a high degree of victim-specific preparation, including prefilled email addresses and anti-analysis techniques like honeypot fields and interaction gating. The campaign leverages npm and package CDNs to create durable hosting infrastructure, making detection and takedown more challenging. After victims interact with the phishing flow, their credentials are redirected to attacker-controlled infrastructure, with identifiers embedded in the URL for tracking. Overlap has been observed between domains used in this campaign and previously documented adversary-in-the-middle (AiTM) phishing infrastructure, indicating a possible connection to known threat actor tactics. Security researchers emphasize the need for increased vigilance among organizations with critical infrastructure exposure, especially those with sales teams that may be targeted through such supply chain abuse of open-source ecosystems.
Jul 12, 2026
Researchers disclosed a campaign using **24 malicious npm packages** as phishing infrastructure, abusing package CDN mirrors such as **unpkg** to publish a single HTML file that renders a fake **Cloudflare CAPTCHA** page. Instead of targeting developers through dependency compromise or malware-laced code, the packages were designed to exploit the trust and availability of npm mirror services, giving attackers a seemingly legitimate hosting channel for phishing content. The operation reportedly evolved after an earlier **Microsoft-themed typosquatted domain** was blocked by Google Chrome Safe Browsing, with the attackers shifting to **KeyVal** as a dead-drop resolver to control redirection targets. Researchers said the current lure redirects users to the legitimate **ChatGPT** website, but warned the same infrastructure can be quickly repointed to **ClickFix-style phishing** pages or malware delivery sites, turning public package mirrors into flexible staging points for social-engineering attacks.
Aug 27, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026