Malicious NPM Packages Used in Sophisticated Developer Cyberattack

In October 2025, security researchers uncovered a phishing campaign that weaponises the npm ecosystem not by infecting package installations but by using the unpkg[.]com CDN as disposable hosting for malicious JavaScript. By seeding over 175 throwaway npm packages, attackers turned a trusted open source delivery network into a large‑scale phishing infrastructure targeting enterprise employees across Europe’s industrial, technology and energy sectors.

Initial public traces appeared on 24 September 2025, with on 9 October Socket disclosing 175 malicious packages under the codename “Beamglea” affecting more than 135 organisations; a follow‑up by Snyk on 10 October identified a related cluster using mad‑x.x.x.x.x.x naming.

Each package hosts a minimal beamglea.js file and HTML “business document” lures that load the script from unpkg[.]com and redirect the user to a credential‑harvesting site, with the URL fragment pre‑filling the user’s email address to boost trust and evade server logs. Some mad‑ packages masquerade as a fake Cloudflare Security Check, employing anti‑devtools techniques and a remote GitHub‑hosted payload URL after the user completes a verification box.

Mitigations include treating external unpkg[.]com loads as high risk, implementing email gateway filters for HTML referencing unpkg[.]com, and monitoring for redirection patterns such as redirect-* and mad-*. according to Socket and according to Snyk.