175 Malicious npm Packages With 26,000 Downloads Attacking Technology, and Energy Companies Worldwide
Socket's Threat Research Team has identified a phishing campaign involving 175 malicious npm packages, which have been downloaded over 26,000 times. This campaign, referred to as "Beamglea," exploits npm's public registry and the unpkg.com CDN to host…
Socket's Threat Research Team has identified a phishing campaign involving 175 malicious npm packages, which have been downloaded over 26,000 times. This campaign, referred to as "Beamglea," exploits npm's public registry and the unpkg.com CDN to host redirect scripts targeting more than 135 companies in technology, energy, and industrial sectors worldwide.
These npm packages do not execute malicious code during installation, instead using the npm ecosystem as a hosting platform for credential harvesting operations.
The packages have randomized names following the pattern redirect-[a-z0-9]{6}, making accidental installation by developers unlikely. However, the high download count suggests scrutiny by security researchers and automated scanners.
The attackers have developed Python tools to automate the campaign, creating HTML phishing lures themed as purchase orders and project documents. The term "beamglea" is used as a tracking identifier for this operation.
Automated Package Generation Infrastructure
The attackers implemented advanced Python automation, utilizing scripts like redirect_generator.py and PyInstaller-compiled executables. This process involves:
Socket's Threat Research Team has identified a phishing campaign involving 175 malicious npm packages, which have been downloaded over 26,000 times.
JavaScript template file (beamglea_template.js) Victim's email address Destination phishing URL
The workflow includes npm authentication, template processing, package creation, publication, and HTML lure generation. Package names are generated with a unique six-character suffix, ensuring distinct campaigns under the redirect- prefix.
The JavaScript payload contains a processAndRedirect() function that appends the victim's email as a URL fragment, which does not appear in server access logs. This adds legitimacy to phishing pages by pre-filling login forms.
def generate_random_package_name(prefix="redirect-"): suffix = ''.join(random.choices(string.ascii_lowercase + string.digits, k=6)) return prefix + suffix
template_js = load_template('beamglea_template.js') final_js = template_js.replace("{{EMAIL}}", email).replace("{{URL}}", redirect_url) with open("beamglea.js", "w", encoding="utf-8") as f: f.write(final_js)
The HTML lures are themed as legitimate business documents, with filenames mimicking purchase orders and project documents. All HTML files contain the campaign identifier nb830r6x for consistent tracking across the packages.
Based on reporting by Cyber Security News.