# Phishing Campaign Leveraging the NPM Ecosystem

DevFeed: [Phishing Campaign Leveraging the NPM Ecosystem](<https://devfeed.tech/articles/phishing-campaign-leveraging-the-npm-ecosystem-8043.md>)

Original publisher: [Read original article](<https://snyk.io/blog/phishing-campaign-leveraging-the-npm-ecosystem/>)

Author: Liran Tal

Published: 2025-10-09T23:00:00Z

Content type: news

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [browser](<https://devfeed.tech/topics/browser.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [browser](<https://devfeed.tech/tags/browser.md>), [cdn](<https://devfeed.tech/tags/cdn.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [snyk-platform](<https://devfeed.tech/tags/snyk-platform.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

## AI overview

A phishing campaign abuses the npm ecosystem and the unpkg CDN to host and deliver JavaScript through crafted HTML business documents. More than 175 disposable packages redirect victims to credential-harvesting sites when opened in a browser, targeting over 135 organizations.

## Source excerpt

A new phishing campaign weaponizes NPM and the unpkg CDN. Over 175 throwaway packages are used to host scripts that redirect users to credential-harvesting sites. The attack targets enterprise employees through the browser, not developers at install time.