New Cyberattack Leverages NPM Ecosystem to Infect Developers While Installing Packages

Cybersecurity Update: NPM Ecosystem Exploitation

Cybersecurity researchers have identified a sophisticated phishing campaign utilizing the NPM ecosystem through a novel attack vector. This operation employs the trusted unpkg.com CDN to deliver phishing scripts directly via browsers, targeting employees in over 135 organizations, primarily within Europe's industrial, technology, and energy sectors.

Discovered in October 2025, the campaign signifies an evolution in supply chain attack methodologies. Threat actors created over 175 temporary NPM packages, serving as disposable hosting for JavaScript code that redirects victims to credential-harvesting sites. The packages use naming patterns such as "redirect-[a-z0-9]{6}" and "mad-x.x.x.x.x.x" to appear legitimate within the NPM registry.

Instead of compromising developers during package installations, attackers distribute HTML files disguised as business documents. When opened, these files execute scripts from the unpkg.com CDN, exploiting the platform's automatic availability feature for published packages. This method repurposes legitimate hosting infrastructure for phishing while circumventing traditional security measures.

Snyk analysts have identified additional package clusters, indicating the campaign's extensive scale. This attack demonstrates threat actors' exploration of new methods to weaponize open-source ecosystems beyond traditional package-based exploits.

Advanced Evasion and Persistence Mechanisms

The malicious payload incorporates multiple layers of protection against security analysis and detection. It includes anti-debugging measures and blocks access to development consoles by blanking pages or redirecting when accessed. The code implements size threshold monitoring and console object manipulation.

const CHECK_INTERVAL = 600; const SIZE_THRESHOLD = 160; const REACTION = 'blank';

function sizeCheck() { return (dw > SIZE_THRESHOLD) || (dh > SIZE_THRESHOLD); }

function consoleCheck() { Object.defineProperty(obj, 'id', { get: function() { open = true; return '1'; } }); console.log(obj); return open; }

The malware also disables standard browser inspection capabilities by intercepting keyboard shortcuts and context menu events. It prevents access to F12 developer tools, Ctrl+Shift+I inspector shortcuts, and Ctrl+U view source functionality through comprehensive event listener implementations. Frame-busting techniques are employed to redirect the top-level window after interaction with fake verification checkboxes, ensuring maximum impact.

Based on reporting by Cyber Security News.