Hackers Weaponize npm to Hunt Critical Infrastructure Sales Teams

The Socket Threat Research Team’s investigation, published on 25 December 2025, reveals a sophisticated spear-phishing operation that abused the npm registry for at least five months to target critical infrastructure sectors in the US and allied nations. According to The Socket Threat Research Team, 27 malicious npm packages were published under six aliases and are not meant to be installed by developers; instead they function as browser-executed phishing components delivered via CDNs.

When a victim clicks the malicious link, the package code wipes the legitimate page and replaces it with a high-fidelity lure, beginning with a fake “MicroSecure” document-sharing verification page and then a Microsoft-branded sign-in prompt. The operation is highly targeted, focusing on sales and commercial personnel rather than IT admins, with Socket identifying 25 distinct targets across manufacturing, industrial automation, plastics and healthcare.

Researchers note the use of lightweight client-side checks and honeypot form fields to detect automation, and describe an Adversary-in-the-Middle phase capable of bypassing MFA by exploiting session data through a threat-actor-controlled proxy. The researchers have reported the malicious packages to the npm security team and notified the targeted organisations.