NPM Infrastructure Abused in Phishing Campaign Aimed at Industrial and Electronics Firms

According to Socket, threat actors are abusing the legitimate NPM infrastructure in a phishing campaign dubbed Beamglea that breaks from typical supply‑chain patterns. The operation has produced over 175 malicious NPM packages, targeting more than 135 organisations in the energy, industrial equipment and technology sectors. The campaigns accumulate over 26,000 downloads, with many downloads coming from security researchers and automated scanners.

The attackers deploy 630 HTML files that direct victims to phishing pages, using unpkg[.]com as the delivery CDN and prompting victims to enter credentials after their email is pre-filled. Snyk notes that similar packages using a “mad-*” naming scheme have been observed, and the targeted firms include Algodue, ArcelorMittal, Demag Cranes, D-Link, H2 Systems, Moxa, Piusi, Renishaw, Sasol, Stratasys and ThyssenKrupp Nucera. The automation, written in Python, creates 175 unique packages and a templated HTML flow that redirects victims to attacker‑controlled domains.