175 Malicious npm Packages: A Comedy of Credential Errors!
Cybersecurity researchers have detected 175 malicious npm packages in a phishing campaign named Beamglea, targeting over 135 companies. These packages, downloaded 26,000 times, exploit npm and UNPKG to host infrastructure for credential harvesting. Developers see no threat, but victims are redirected to phishing sites, highlighting the evolving tactics of threat actors.
Hot Take:
Who knew that the npm registry was moonlighting as a phishing assistant? It’s like finding out your friendly neighborhood cat is actually masterminding a global credential-harvesting campaign. Hold on to your keyboards, developers – it’s getting wild out there!
Key Points:
- 175 malicious npm packages acting as infrastructure for a phishing campaign named Beamglea.
- Packages have been downloaded 26,000 times, targeting over 135 companies globally.
- Packages use npm’s public registry and unpkg.com’s CDN to host redirect scripts.
- HTML files masquerade as legitimate documents to redirect victims to phishing sites.
- Attack leverages npm and UNPKG without direct malicious execution upon installation.
Already a member? Log in here