The npm registry used as infrastructure for targeted phishing

Socket has identified a long-running targeted phishing campaign that used the npm registry as hosting and delivery infrastructure. Over at least five months the actors published 27 malicious packages under six publisher aliases. The packages served browser-executed phishing lures imitating secure document-sharing workflows and Microsoft sign-in pages. The lures were delivered through npm's CDN and included interaction gating and anti-analysis controls. Targets were individuals across 25 organisations in manufacturing, industrial automation, plastics and healthcare in the United States and allied countries, with hard-coded addresses prefilling the login prompt.

What this means for your organisation

Links to a package registry's CDN look legitimate and pass filters that judge domain reputation. Having the recipient's own address prefilled makes the page more convincing to whoever clicks. Industrial firms and suppliers to the defence and healthcare sectors sit squarely in the described target group.

Berigo recommends

• Deploy phishing-resistant multi-factor authentication on Microsoft accounts so stolen passwords are not enough.
• Treat links to package registry CDNs as suspicious in email to non-technical staff.
• Teach staff that a login page with their address already filled in is a warning sign, not a convenience.
• Alert on new sign-ins and device registrations in Microsoft 365.

Source

• socket.dev