Beamglea Campaign: Hackers Abuse 175 npm Packages and unpkg CDN for Large-Scale Phishing

Socket’s Threat Research Team has uncovered a large-scale supply-chain abuse campaign, dubbed Beamglea, that uses 175 malicious npm packages and the unpkg CDN to run phishing operations, with more than 26,000 downloads and targeting over 135 organisations worldwide. The npm packages themselves are non-executable; instead they store and serve redirect scripts that forward users to credential-harvesting pages hosted on attacker-controlled domains, bypassing many filters and SSL checks.

Each package follows a naming pattern like redirect-[six characters], and contains beamglea.js, hosted automatically on unpkg[.]com, a legitimate CDN. The campaign generated over 630 HTML phishing lures and relied on automated tooling that mass-produced packages, publishing them via nine npm author accounts, and creating new infrastructure on demand. The operators also included a cdn_setup_guide.txt in some packages, outlining plans to migrate to VPS-hosted CDNs, suggesting long-term operational intent.

The phishing pages impersonated legitimate portals and collected victim data, with at least 135 targeted addresses across Western Europe and Asia-Pacific, while US-based targets were notably absent.