27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials

Cybersecurity researchers disclosed a sustained and targeted spear-phishing operation that published 27 npm packages from six aliases to host browser-based lures that mimic document-sharing portals and Microsoft sign-in, with the aim of credential theft.

According to Socket, the campaign targeted 25 organisations across manufacturing, industrial automation, plastics and polymer supply chains, healthcare, and related sectors in the U.S. and allied nations, and the packages were designed to run as embedded HTML/JavaScript in phishing pages rather than requiring installation.

The researchers note that the package CDNs offered resilience to takedowns and allowed attackers to switch aliases and names easily, with the JavaScript obfuscated or minified and checks to evade analysis. The operation also included honeypot form fields and anti-analysis measures, such as requiring mouse or touch input before proceeding, and 25 email addresses tied to specific individuals were hard-coded into some of the phishing flows.

The domains used in the packages were linked to adversary-in-the-middle infrastructure associated with Evilginx, and the incident follows earlier npm-based campaigns such as Beamglea.