175 Malicious npm Packages Targeting Tech and Energy Firms, 26,000 Downloads

According to Socket’s Threat Research Team, 175 malicious npm packages have been identified that target tech and energy firms, amassing over 26,000 downloads in a sprawling Beamglea phishing campaign. The packages act as hosting infrastructure, redirecting victims to credential-harvesting pages rather than executing code at install time, with each package publishing a redirect-[a-z0-9]{6} name pattern and leveraging unpkg[.]com to serve assets over HTTPS.

Automated tooling written in Python and PyInstaller publishes uniquely named packages and injects victim data into a JavaScript template, generating more than 630 HTML files across the 175 packages and embedding a campaign identifier in a meta tag. Victims receive HTML lures—often embedded in emails—that load scripts from URLs such as https://unpkg[.]com/redirect-xs13nr@1.0.0/beamglea.js, and the target's email is exfiltrated via a URL fragment to pre-fill login forms on phishing pages.

Targets include more than 135 industrial, technology, and energy companies across Western Europe, the Nordics, and Asia-Pacific, with seven phishing domains registered, including cfn.jackpotmastersdanske[.]com and musicboxcr[.]com. The campaign relies on legitimate infrastructure, mitigations include strong MFA, and defenders should treat any IOC detected as an active breach.