175 Malicious npm Packages with 26,000 Downloads Used in Credential Phishing Campaign

Cybersecurity researchers have flagged a new set of 175 malicious npm packages that have collectively been downloaded 26,000 times and are being used to support a credential harvesting campaign codenamed Beamglea, targeting more than 135 industrial, technology, and energy companies worldwide, according to Socket.

The campaign leverages the npm registry and unpkg[.]com CDN to host redirect scripts that route victims to credential harvesting pages, with the library including a Python file named redirect_generator.py to programmatically create and publish packages named redirect-xxxxx where x is a random alphanumeric string.

Once live, the malware generates an HTML file referencing the UNPKG CDN and a beamglea.js script that pre-fills the victim’s email and redirects to a phishing domain, enabling the attacker to capture credentials; Socket notes more than 630 HTML files masquerade as purchase orders, technical specifications or project documents.

The analysis emphasises that the npm packages are not designed to execute malicious code on installation; instead, they enable a scalable phishing infrastructure using trusted services, according to Kush Pandya, a security researcher, who described the ecosystem as an unwitting infrastructure.