Loading story…
A threat actor identified as 'dino_reborn' published seven packages to the npm registry, six of which contain malicious JavaScript designed to redirect victims to cryptocurrency scam sites. These packages leverage the Adspect cloud-based service to implement cloaking techniques, distinguishing between regular users and security researchers by collecting browser and environment data. If a visitor is identified as a potential victim, they are shown a fake CAPTCHA and ultimately redirected to a malicious site, while researchers are served a decoy page to evade detection. The packages involved are: signals-embed, dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830, with only signals-embed acting as a decoy and the rest containing the 39kB malicious payload.
The malicious code is automatically executed in the browser via an Immediately Invoked Function Expression (IIFE) and includes anti-analysis features such as blocking right-click, F12, and other developer tools shortcuts, as well as reloading the page if DevTools is detected. The Socket Threat Research Team discovered the campaign and submitted takedown requests, resulting in npm placing the packages in security holding. The attack highlights the increasing sophistication of supply chain threats in open-source ecosystems, particularly through the use of advanced cloaking and anti-analysis techniques to evade detection and target end users.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Following the discovery, Socket notified npm about the malicious packages. The identified packages were then removed from the npm registry.
Socket Threat Research publicly reported the supply-chain campaign, detailing the use of cloaking, anti-analysis techniques, visitor fingerprinting, and delayed redirects to scam infrastructure. Multiple outlets subsequently covered the same disclosure.
Researchers observed the packages using Adspect through an attacker-controlled proxy to decide whether to redirect users to fake CAPTCHA pages and crypto-themed scam sites or show benign decoy content. The lures referenced brands such as StandX, Jupiter, and Uniswap, while suspected researchers could be sent to a fake 'Offlido' company site.
An actor using the npm profile 'dino_reborn' published seven malicious packages that embedded browser-executed code. The packages were designed to fingerprint visitors, evade analysis, and support cryptocurrency scam redirections.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcegetsafety.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcesocket.dev
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple malicious npm packages have been discovered targeting developers by employing advanced obfuscation techniques and typosquatting to mimic popular legitimate packages such as *TypeScript*, *discord.js*, *ethers.js*, *nodemon*, and *Claude Code*. Security researchers revealed that these packages use up to four layers of obfuscation—including eval wrapping, XOR encryption, URL encoding, and control flow manipulation—to evade static analysis and conceal credential-stealing malware. The attack chain often begins with deceptive tactics, such as displaying fake CAPTCHAs, and proceeds to exfiltrate sensitive information like IP addresses and credentials to attacker-controlled servers. In one notable case, a package impersonating the official Anthropic CLI was found to proxy commands and data back to the threat actor, enabling both credential theft and remote command execution. These incidents highlight the persistent risks posed by weak validation and oversight in the npm ecosystem, allowing threat actors to publish lookalike packages that are difficult to distinguish from legitimate ones. The sophisticated payloads not only target local developer environments but can also compromise CI/CD pipelines, amplifying the potential impact. Security experts emphasize the need for improved package metadata validation and greater vigilance among developers to mitigate the risk of supply chain attacks through open-source dependencies.
Jun 29, 2026
Cybersecurity researchers have identified a sophisticated phishing campaign, codenamed Beamglea, that leverages 175 malicious packages published on the npm registry to facilitate credential harvesting attacks. The campaign has targeted over 135 organizations across industrial, technology, and energy sectors worldwide. The malicious packages, which have been collectively downloaded more than 26,000 times, serve as infrastructure rather than directly infecting systems upon installation. Instead of executing malicious code during installation, these packages are designed to exploit npm’s public registry and the unpkg.com CDN to host and distribute redirect scripts. These scripts are embedded in HTML files that masquerade as legitimate documents such as purchase orders or technical specifications. When opened, the HTML files load JavaScript from the unpkg CDN, which then redirects victims to credential harvesting pages, often targeting Microsoft account credentials. The packages are programmatically generated using a Python script named 'redirect_generator.py', which creates packages with randomized names like 'redirect-xxxxxx', injects the victim’s email address, and a custom phishing URL. This automation allows the threat actors to rapidly scale their infrastructure and personalize attacks. The campaign was initially flagged by Paul McCarty at Safety in late September 2025, and further expanded upon by Socket’s Threat Research Team, who discovered additional packages and provided a comprehensive analysis. The download counts for these packages are believed to be inflated by automated scanners, security researchers, and CDN infrastructure, rather than widespread accidental installation by developers. The threat actors’ abuse of trusted infrastructure like npm and unpkg.com makes detection and mitigation more challenging, as these services are widely used and considered reputable within the software development community. At the time of reporting, most of the malicious packages remained live, prompting researchers to petition for their removal and the suspension of the associated threat actor accounts. The campaign’s use of randomized package names and the lack of direct malicious payloads in the packages themselves further complicate traditional detection methods. The operation’s codename, Beamglea, appears to be unique to this campaign, with no prior online presence, aiding in tracking and attribution. Researchers have identified over 630 HTML files associated with the campaign, each crafted to lure victims into providing sensitive credentials. The campaign highlights the growing trend of abusing open-source package registries and CDNs as free, scalable infrastructure for phishing operations. Security teams are advised to monitor for suspicious npm packages and scrutinize the use of unpkg.com-hosted scripts in their environments. The incident underscores the importance of supply chain vigilance and the need for enhanced monitoring of public code repositories for abuse.
Jul 12, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026