Loading story…
Researchers disclosed a campaign using 24 malicious npm packages as phishing infrastructure, abusing package CDN mirrors such as unpkg to publish a single HTML file that renders a fake Cloudflare CAPTCHA page. Instead of targeting developers through dependency compromise or malware-laced code, the packages were designed to exploit the trust and availability of npm mirror services, giving attackers a seemingly legitimate hosting channel for phishing content.
The operation reportedly evolved after an earlier Microsoft-themed typosquatted domain was blocked by Google Chrome Safe Browsing, with the attackers shifting to KeyVal as a dead-drop resolver to control redirection targets. Researchers said the current lure redirects users to the legitimate ChatGPT website, but warned the same infrastructure can be quickly repointed to ClickFix-style phishing pages or malware delivery sites, turning public package mirrors into flexible staging points for social-engineering attacks.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
Socket reported in October 2025 that 175 npm packages abused unpkg.com's CDN to host redirect scripts in a campaign dubbed Beamglea. The campaign routed victims to credential-harvesting pages.
OX Security researchers disclosed a cluster of 24 malicious npm packages that abuse npm mirrors such as unpkg to render fake Cloudflare CAPTCHA pages. Rather than targeting developers who install them, the packages were used as free, trusted-looking phishing hosting infrastructure.
After the earlier domain was blocklisted, the actor moved to using api.keyval[.]org as a dead drop resolver. The mirrored HTML pages retrieved and decoded redirect URLs from the public key-value service.
Google Chrome Safe Browsing blocklisted login[.]microsofte[.]live during the campaign. This defensive action forced the threat actor to change tactics.
Early versions of the campaign used the typosquatted domain login[.]microsofte[.]live, which impersonated a Microsoft login page. The malicious npm packages' mirrored HTML pages queried this infrastructure as part of the redirect flow.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
6 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourceox.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity researchers have identified a sophisticated phishing campaign, codenamed Beamglea, that leverages 175 malicious packages published on the npm registry to facilitate credential harvesting attacks. The campaign has targeted over 135 organizations across industrial, technology, and energy sectors worldwide. The malicious packages, which have been collectively downloaded more than 26,000 times, serve as infrastructure rather than directly infecting systems upon installation. Instead of executing malicious code during installation, these packages are designed to exploit npm’s public registry and the unpkg.com CDN to host and distribute redirect scripts. These scripts are embedded in HTML files that masquerade as legitimate documents such as purchase orders or technical specifications. When opened, the HTML files load JavaScript from the unpkg CDN, which then redirects victims to credential harvesting pages, often targeting Microsoft account credentials. The packages are programmatically generated using a Python script named 'redirect_generator.py', which creates packages with randomized names like 'redirect-xxxxxx', injects the victim’s email address, and a custom phishing URL. This automation allows the threat actors to rapidly scale their infrastructure and personalize attacks. The campaign was initially flagged by Paul McCarty at Safety in late September 2025, and further expanded upon by Socket’s Threat Research Team, who discovered additional packages and provided a comprehensive analysis. The download counts for these packages are believed to be inflated by automated scanners, security researchers, and CDN infrastructure, rather than widespread accidental installation by developers. The threat actors’ abuse of trusted infrastructure like npm and unpkg.com makes detection and mitigation more challenging, as these services are widely used and considered reputable within the software development community. At the time of reporting, most of the malicious packages remained live, prompting researchers to petition for their removal and the suspension of the associated threat actor accounts. The campaign’s use of randomized package names and the lack of direct malicious payloads in the packages themselves further complicate traditional detection methods. The operation’s codename, Beamglea, appears to be unique to this campaign, with no prior online presence, aiding in tracking and attribution. Researchers have identified over 630 HTML files associated with the campaign, each crafted to lure victims into providing sensitive credentials. The campaign highlights the growing trend of abusing open-source package registries and CDNs as free, scalable infrastructure for phishing operations. Security teams are advised to monitor for suspicious npm packages and scrutinize the use of unpkg.com-hosted scripts in their environments. The incident underscores the importance of supply chain vigilance and the need for enhanced monitoring of public code repositories for abuse.
Jul 12, 2026
A threat actor identified as 'dino_reborn' published seven packages to the npm registry, six of which contain malicious JavaScript designed to redirect victims to cryptocurrency scam sites. These packages leverage the Adspect cloud-based service to implement cloaking techniques, distinguishing between regular users and security researchers by collecting browser and environment data. If a visitor is identified as a potential victim, they are shown a fake CAPTCHA and ultimately redirected to a malicious site, while researchers are served a decoy page to evade detection. The packages involved are: signals-embed, dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830, with only signals-embed acting as a decoy and the rest containing the 39kB malicious payload. The malicious code is automatically executed in the browser via an Immediately Invoked Function Expression (IIFE) and includes anti-analysis features such as blocking right-click, F12, and other developer tools shortcuts, as well as reloading the page if DevTools is detected. The Socket Threat Research Team discovered the campaign and submitted takedown requests, resulting in npm placing the packages in security holding. The attack highlights the increasing sophistication of supply chain threats in open-source ecosystems, particularly through the use of advanced cloaking and anti-analysis techniques to evade detection and target end users.
Jun 29, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026