175 Malicious npm Packages Exploited in the Beamglea Phishing Campaign

• 14/10/2025

While developers continue to rely on open-source libraries like npm to save development time, cybercriminals are finding new ways to turn these trusted platforms into phishing infrastructures. A sophisticated campaign named Beamglea has recently been discovered, revealing that 175 malicious npm packages were used to carry out a large-scale phishing attack targeting Microsoft accounts worldwide.

According to reports, these malicious npm packages were downloaded more than 26,000 times—mostly by security researchers, automated scanners, or CDNs after detection alerts were issued. What makes this campaign particularly alarming is that the malicious code doesn’t behave like traditional malware. Instead, it leverages legitimate infrastructures such as npm and UNPKG (a public CDN service) to host and redirect users to phishing sites.

The campaign targeted over 135 organizations across industries including manufacturing, technology, and energy. Researcher Kush Pandya noted:

“npm is being unintentionally transformed into an infrastructure that serves cybercriminals, rather than being directly exploited as a tool for attack.”

The malicious npm packages in the Beamglea campaign were generated automatically using a Python script named redirect_generator.py. This script created random packages (e.g., “redirect-xxxxxx”), embedding victims’ email addresses and phishing URLs into the package source code.

Once published on npm, each package produced an HTML file containing a link to a malicious JavaScript file hosted on UNPKG (e.g., unpkg.com/redirect-xs13nr@1.0.0/beamglea.js). When a victim opened the HTML file in a browser, the JavaScript automatically redirected them to a fake Microsoft login page.

A key detail of the attack: the victim’s email address was pre-filled in the phishing page, making it appear like a legitimate Microsoft login portal. This small trick significantly reduced suspicion and increased the success rate of the attack.
 

he phishing HTML files were cleverly disguised with names such as “purchase order,” “technical document,” or “project collaboration,” tricking recipients into believing they were internal business files. Security company Socket reported discovering more than 630 such HTML files embedded within the compromised npm packages.

The true danger of Beamglea lies in its ability to exploit legitimate infrastructure without needing dedicated malicious servers:

•  Completely free: npm and UNPKG are public services.

•  Hard to block: hosted within trusted platforms, making blanket blocking impractical.

•  Difficult to detect: packages contain no direct malware at installation.

In short, Beamglea has effectively turned npm into a “free hosting server for phishing.” This sets a dangerous precedent, showing how easily open-source ecosystems can be abused for cybercrime.

Beamglea highlights how hackers are evolving — instead of direct attacks, they now hide within legitimate processes, bypassing automated security tools. This is not an npm vulnerability, but rather a systemic risk in how open-source and cloud infrastructures are managed and monitored.

How to Stay Protected

• Do not open unfamiliar HTML files received via email, especially those labeled “orders” or “technical documents.”

•  Developers: Verify npm packages carefully before use. Avoid installing from unknown or randomly named sources.

•  Organizations: Monitor CDN traffic and block suspicious requests to domains like unpkg.com.

•  Security training: Educate employees to recognize phishing attempts, especially in industries frequently targeted.

The Beamglea campaign proves that cybercriminals no longer need to build new tools — they just repurpose what’s already trusted. In today’s open-source and cloud-driven world, the line between “secure infrastructure” and “weaponized platform” has never been thinner.

Cybersecurity is no longer just about blocking malware — it’s about understanding how attackers exploit trust itself. A single careless click can trigger a global cyberattack.

(Information referenced from Whitehat)