Loading story…
A sophisticated spearphishing campaign has been uncovered targeting sales and commercial personnel at critical infrastructure-adjacent organizations, particularly in the United States and allied nations. Threat actors have weaponized the npm registry by publishing at least 27 malicious packages under multiple aliases, using them as a distribution layer for browser-based phishing components. These packages deliver client-side HTML and JavaScript lures that impersonate secure document-sharing workflows and Microsoft sign-in pages, with the intent to harvest credentials from targeted individuals in sectors such as manufacturing, industrial automation, plastics, and healthcare. The operation demonstrates a high degree of victim-specific preparation, including prefilled email addresses and anti-analysis techniques like honeypot fields and interaction gating.
The campaign leverages npm and package CDNs to create durable hosting infrastructure, making detection and takedown more challenging. After victims interact with the phishing flow, their credentials are redirected to attacker-controlled infrastructure, with identifiers embedded in the URL for tracking. Overlap has been observed between domains used in this campaign and previously documented adversary-in-the-middle (AiTM) phishing infrastructure, indicating a possible connection to known threat actor tactics. Security researchers emphasize the need for increased vigilance among organizations with critical infrastructure exposure, especially those with sales teams that may be targeted through such supply chain abuse of open-source ecosystems.
Get the infrastructure and lures behind it.
6 events from the most recent confirmed update back to the earliest known activity.
A follow-up report publicly described the weaponization of npm to target sales teams in critical infrastructure sectors, emphasizing the campaign's likely role as an entry point into sensitive organizations. This report did not add a distinct new incident beyond the previously disclosed campaign.
Socket reported the campaign and malicious npm accounts to npm security, requested account suspension, and notified the 25 targeted organizations with indicators for triage. This marked the first documented defensive response described in the references.
Researchers found embedded domains and URL patterns overlapping with publicly documented Evilginx adversary-in-the-middle redirector behavior. This indicated the operation may have been capable of stealing session cookies or tokens and bypassing MFA, not just harvesting passwords.
Socket Threat Research Team determined the campaign targeted 25 distinct individuals, mainly sales and commercial staff in manufacturing, industrial automation, plastics, and healthcare organizations in the U.S. and allied countries. The activity suggested a highly selective operation aimed at critical-infrastructure-adjacent sectors.
Threat actors uploaded 27 malicious npm packages across six npm publisher aliases to support the phishing campaign. The packages contained hardcoded victim email addresses and phishing components designed to prefill targets' details and redirect them to actor-controlled infrastructure.
A targeted spearphishing operation abusing the npm registry and package CDNs as hosting for browser-based phishing lures was active for at least five months before it was reported. The campaign focused on impersonating secure document-sharing workflows and Microsoft sign-in pages to capture credentials from selected victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity researchers have identified a sophisticated phishing campaign, codenamed Beamglea, that leverages 175 malicious packages published on the npm registry to facilitate credential harvesting attacks. The campaign has targeted over 135 organizations across industrial, technology, and energy sectors worldwide. The malicious packages, which have been collectively downloaded more than 26,000 times, serve as infrastructure rather than directly infecting systems upon installation. Instead of executing malicious code during installation, these packages are designed to exploit npm’s public registry and the unpkg.com CDN to host and distribute redirect scripts. These scripts are embedded in HTML files that masquerade as legitimate documents such as purchase orders or technical specifications. When opened, the HTML files load JavaScript from the unpkg CDN, which then redirects victims to credential harvesting pages, often targeting Microsoft account credentials. The packages are programmatically generated using a Python script named 'redirect_generator.py', which creates packages with randomized names like 'redirect-xxxxxx', injects the victim’s email address, and a custom phishing URL. This automation allows the threat actors to rapidly scale their infrastructure and personalize attacks. The campaign was initially flagged by Paul McCarty at Safety in late September 2025, and further expanded upon by Socket’s Threat Research Team, who discovered additional packages and provided a comprehensive analysis. The download counts for these packages are believed to be inflated by automated scanners, security researchers, and CDN infrastructure, rather than widespread accidental installation by developers. The threat actors’ abuse of trusted infrastructure like npm and unpkg.com makes detection and mitigation more challenging, as these services are widely used and considered reputable within the software development community. At the time of reporting, most of the malicious packages remained live, prompting researchers to petition for their removal and the suspension of the associated threat actor accounts. The campaign’s use of randomized package names and the lack of direct malicious payloads in the packages themselves further complicate traditional detection methods. The operation’s codename, Beamglea, appears to be unique to this campaign, with no prior online presence, aiding in tracking and attribution. Researchers have identified over 630 HTML files associated with the campaign, each crafted to lure victims into providing sensitive credentials. The campaign highlights the growing trend of abusing open-source package registries and CDNs as free, scalable infrastructure for phishing operations. Security teams are advised to monitor for suspicious npm packages and scrutinize the use of unpkg.com-hosted scripts in their environments. The incident underscores the importance of supply chain vigilance and the need for enhanced monitoring of public code repositories for abuse.
Jul 12, 2026
North Korean state-sponsored threat actors have significantly escalated their 'Contagious Interview' campaign by flooding the npm registry with over 338 malicious packages designed to steal cryptocurrency and sensitive credentials. The operation leverages a repeatable playbook, with threat actors creating more than 180 fake personas and using new npm aliases and registration emails to distribute the malware. These malicious packages have collectively been downloaded over 50,000 times, indicating a substantial reach and potential impact on the developer community. The attackers primarily target Web3, cryptocurrency, and blockchain developers, as well as technical job seekers, often approaching them on LinkedIn under the guise of recruiters or hiring managers. The campaign follows a multi-stage attack chain, beginning with reconnaissance on social media, followed by weaponization through the publication of typosquatted npm packages. Delivery occurs via recruiter lures, leading to exploitation through malware loaders that execute in memory. The malware tooling has evolved, with initial stages using direct BeaverTail droppers, and more recent waves employing HexEval, XORIndex, and encrypted loaders that reconstruct BeaverTail in memory. Once executed, these loaders typically fetch the InvisibleFerret backdoor, which establishes persistence and enables further malicious actions. The attackers use over a dozen command and control endpoints to manage the compromised systems. The campaign is iterative, with new malicious packages appearing weekly and loader code being regularly tweaked to evade detection. The npm security team has been notified, and takedown requests have been submitted, but as of the latest reports, 25 malicious packages remain live on the registry. The operation has resulted in multi-stage compromises, including the theft of wallet keys and sensitive credentials, leading to financial losses for victims. The attackers' use of social engineering, technical obfuscation, and rapid distribution across new aliases demonstrates a high level of sophistication and adaptability. The campaign has been mapped to the Lockheed Martin Cyber Kill Chain, illustrating its comprehensive approach from reconnaissance to actions on objectives. Security researchers emphasize the need for heightened vigilance among developers, especially those in the cryptocurrency and blockchain sectors, and recommend immediate review of npm dependencies and enhanced monitoring for suspicious package activity. The ongoing nature of the campaign and the attackers' ability to quickly adapt their tactics pose a persistent threat to the software supply chain. Organizations are urged to implement robust security controls, educate staff about social engineering risks, and coordinate with npm and security vendors to mitigate exposure. The incident highlights the growing risk of supply chain attacks via open-source ecosystems and the need for industry-wide collaboration to address such threats.
Jun 29, 2026
Researchers linked a threat actor tracked as **RED-LILI** to a large-scale software supply chain attack that pushed nearly **800 malicious packages** to the **npm** registry in a burst of activity over roughly a week. Checkmarx reported the operation began around February 23, 2022, and relied on a highly automated pipeline that created a separate npm account for each package, complicating bulk detection and takedown efforts. The campaign used custom Python tooling, Selenium, and the open-source **Interactsh** project to automate account creation and bypass npm email one-time-password verification during signup. The malicious packages were part of a broader effort to compromise developers and downstream environments through common package ecosystem abuse techniques, including **typosquatting** and **dependency confusion**. Reporting tied the activity to packages crafted to target organizations such as **Azure, Uber, and Airbnb**, underscoring how attackers can industrialize package publication at scale and turn open-source repositories into an efficient delivery channel for supply chain compromise.
Aug 15, 2026