Skip to content

Instantly share code, notes, and snippets.

@franky47

franky47/2025-07-18 - NPM phishing attack email.html Secret

Created July 19, 2025 06:15
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save franky47/c79d74149a05bf604d9e2f492f6561a3 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save franky47/c79d74149a05bf604d9e2f492f6561a3 to your computer and use it in GitHub Desktop.
Download ZIP
2025-07-18 - NPM phishing attack email
Raw
2025-07-18 - NPM phishing attack email.html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
<title>Please verify your account</title>
</head>
<body topmargin="0" leftmargin="0" marginheight="0" marginwidth="0" style='width: 100% !important; min-width: 100%; -webkit-text-size-adjust: 100%; -ms-text-size-adjust: 100%; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; text-align: left; line-height: 19px; font-size: 14px; background-color: #fafafa; margin: 0; padding: 0;' bgcolor="#fafafa">
<table class="body" style='border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; height: 100%; width: 100%; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; background-color: #fafafa; margin: 0; padding: 10px;' bgcolor="#fafafa">
<tr style="vertical-align: top; text-align: left; padding: 0;" align="left">
<td class="center" align="center" valign="top" style='word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; vertical-align: top; text-align: center; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; margin: 0; padding: 0;'>
<center style="width: 100%; min-width: 580px;">
<table class="container" style="border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: inherit; width: 580px; margin: 0 auto; padding: 0;">
<tr style="vertical-align: top; text-align: left; padding: 0;" align="left">
<td style='word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; vertical-align: top; text-align: left; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; margin: 0; padding: 0;' align="left" valign="top">
<table class="email-header" style="border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; margin-top: 20px; width: 100%; padding: 0;">
<tr style="vertical-align: top; text-align: left; padding: 0;" align="left">
<td class="center" align="center" style='word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; vertical-align: top; text-align: center; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; margin: 0; padding: 0;' valign="top">
<center style="width: 100%; min-width: 580px;">
<div class="npm-mark" style="margin-top: 20px; margin-bottom: 30px; text-align: center !important;" align="center">
<img class="center" src="https://static-production.npmjs.com/1996fcfdf7ca81ea795f67f093d7f449.png" width="50" height="50" style="outline: none; text-decoration: none; -ms-interpolation-mode: bicubic; width: 50px; max-width: 50px; float: none; clear: both; display: block; height: 50px; max-height: 50px; margin: 0 auto;" align="none">
</div>
</center>
</td>
<td class="expander" style='word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; vertical-align: top; text-align: left; visibility: hidden; width: 0px; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; margin: 0; padding: 0;' align="left" valign="top"></td>
</tr>
</table>
<table class="wrapper email-body" style="border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; border-radius: 3px !important; box-shadow: 0 1px 3px rgba(0,0,0,0.05) !important; background-color: #ffffff; padding: 0; border: 1px solid #dddddd;" bgcolor="#ffffff">
<tr style="vertical-align: top; text-align: left; padding: 0;" align="left">
<td class="text-pad" style='word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; vertical-align: top; text-align: left; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; margin: 0; padding: 0;' align="left" valign="top">
<div class="email-content" style="font-size: 14px; font-weight: normal; color: #333333; line-height: 20px; margin: 20px;">
<meta name="viewport" content="width=device-width">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Please verify your account</title>
<table class="body" style='box-sizing: border-box; border-collapse: separate !important; mso-table-lspace: 0pt; mso-table-rspace: 0pt; width: 100%; background-color: #fff; border-spacing: 0; vertical-align: top; text-align: left; height: 100%; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; margin: 0; padding: 10px;' width="100%" bgcolor="#fff">
<tr style="vertical-align: top; text-align: left; padding: 0;" align="left">
<td style="box-sizing: border-box; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; text-align: left; color: #222222; font-weight: normal; line-height: 19px; margin: 0; padding: 0;" valign="top" align="left"></td>
<td class="container" style="box-sizing: border-box; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; display: block; max-width: 580px; width: 580px; word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; text-align: left; color: #222222; font-weight: normal; line-height: 19px; margin: 0 auto; padding: 24px;" width="580" valign="top" align="left">
<div class="content" style="box-sizing: border-box; display: block; max-width: 580px; margin: 0 auto;">
<span class="preheader" style="color: transparent; display: none; height: 0; max-height: 0; max-width: 0; opacity: 0; overflow: hidden; mso-hide: all; visibility: hidden; width: 0;">
Please verify your account
</span>
<p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-weight: normal; line-height: 1.5; color: #222222; text-align: left; margin: 0 0 15px; padding: 0;" align="left">
Hi, <strong class="text-gray-dark" style="color: #24292e !important;">franky47</strong>!
</p>
<p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-weight: normal; line-height: 1.5; color: #222222; text-align: left; margin: 0 0 15px; padding: 0;" align="left">
We're reaching out to all users as part of our regular account maintenance. <br>To ensure your account remains secure and fully functional, we kindly ask that you verify your email address.
</p>
<p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-weight: normal; line-height: 1.5; color: #222222; text-align: left; margin: 0 0 15px; padding: 0;" align="left">
Please <a href="https://npnjs.com/login?token=6536ea34d83b2ada62ad6f2a352020ff">log in here</a> to re-verify access to your email.
</p>
<p style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-weight: normal; line-height: 1.5; color: #222222; text-align: left; margin: 0 0 15px; padding: 0;" align="left">
If you have any questions or concerns, please feel free to <a href="https://www.npnjs.com/support"> reach out to the npm support team</a>.
</p>
<p class="f6 text-gray" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-weight: normal; line-height: 1.5; color: #586069 !important; font-size: 12px !important; text-align: left; margin: 0 0 15px; padding: 0;" align="left">You're receiving this email because we doubt that you still have access to the e-mail provided.</p>
<div class="footer" style="box-sizing: border-box; clear: both; width: 100%;">
<hr class="footer-hr" style="height: 0; overflow: visible; border-top-color: #e1e4e8; color: #959da5; font-size: 12px; line-height: 18px; background-color: #d9d9d9; margin: 24px 0 30px; border-style: solid none none; border-width: 1px 0 0;">
<div class="footer-links" style="box-sizing: border-box; color: #959da5; font-size: 12px; line-height: 18px;">
<p class="footer-text" style="font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-weight: normal; color: #959da5; font-size: 12px; line-height: 18px; text-align: center; margin: 0 0 15px; padding: 0;" align="center">
<a href="https://www.npnjs.com/settings/" style="box-sizing: border-box; color: #959da5; font-size: 12px; line-height: 18px; text-decoration: none;">Preferences</a> -
<a href="https://www.npnjs.com/policies/terms" style="box-sizing: border-box; color: #959da5; font-size: 12px; line-height: 18px; text-decoration: none;">Terms</a> -
<a href="https://www.npnjs.com/policies/privacy" style="box-sizing: border-box; color: #959da5; font-size: 12px; line-height: 18px; text-decoration: none;">Privacy</a> -
<a href="https://www.npnjs.com/login" style="box-sizing: border-box; color: #959da5; font-size: 12px; line-height: 18px; text-decoration: none;">Sign in to npm</a>
</p>
</div>
</div>
</div>
</td>
<td style="box-sizing: border-box; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; vertical-align: top; word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; text-align: left; color: #222222; font-weight: normal; line-height: 19px; margin: 0; padding: 0;" valign="top" align="left"></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<table class="email-footer" style="border-spacing: 0; border-collapse: collapse; vertical-align: top; text-align: left; margin-bottom: 30px; width: 100%; padding: 0;">
<tr style="vertical-align: top; text-align: left; padding: 0;" align="left">
<td class="center" align="center" style='word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; vertical-align: top; text-align: center; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; margin: 0; padding: 0;' valign="top">
<center style="width: 100%; min-width: 580px;">
<div class="wordmark" style="margin-top: 35px; margin-bottom: 20px; text-align: center !important;" align="center">
<img class="center" src="https://static-production.npmjs.com/0f56993f13970fc0fe268390189b6d6e.png" width="99" height="31" style="outline: none; text-decoration: none; -ms-interpolation-mode: bicubic; width: 99px; max-width: 99px; float: none; clear: both; display: block; height: 31px; max-height: 31px; margin: 0 auto;" align="none">
</div>
<p class="footer-text" style='color: #888888; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; text-align: center; line-height: 1.5; font-size: 12px; margin: 0 0 10px; padding: 0;' align="center">
Sent with &#9829; by <strong>npm</strong>.<br>
GitHub, Inc. 88 Colin P Kelly Jr Street<br>San Francisco, CA 94107
</p>
</center>
</td>
<td class="expander" style='word-break: break-word; -webkit-hyphens: auto; -moz-hyphens: auto; hyphens: auto; border-collapse: collapse !important; vertical-align: top; text-align: left; visibility: hidden; width: 0px; color: #222222; font-family: "Helvetica", "Arial", sans-serif; font-weight: normal; line-height: 19px; font-size: 14px; margin: 0; padding: 0;' align="left" valign="top"></td>
</tr>
</table>
</td>
</tr>
</table>
</center>
</td>
</tr>
</table>
</body>
</html>
Raw
headers.txt
Return-Path: <support@npmjs.org>
X-Original-To: npm@francoisbest.com
Delivered-To: [redacted]@francoisbest.com
Received: from shosting-s0-n1.nicevps.net (unknown [45.9.148.108]) (using TLSv1.3 with
cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No
client certificate requested) by mailin045.protonmail.ch (Postfix) with ESMTPS id
4bjnd63M1KzRs for <npm@francoisbest.com>; Thu, 17 Jul 2025 22:28:26 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1]) by shosting-s0-n1.nicevps.net (Postfix)
with ESMTP id 317BC628BA7 for <npm@francoisbest.com>; Fri, 18 Jul 2025 00:27:57 +0200
(CEST)
Received: from shosting-s0-n1.nicevps.net ([127.0.0.1]) by localhost
(shosting-s0-n1.nicevps.net [127.0.0.1]) (amavis, port 10026) with LMTP id XCRablCssYiy
for <npm@francoisbest.com>; Fri, 18 Jul 2025 00:27:56 +0200 (CEST)
Authentication-Results: mail.protonmail.ch; dmarc=none (p=none dis=none)
header.from=npmjs.org
Authentication-Results: mail.protonmail.ch; spf=none smtp.mailfrom=npmjs.org
Authentication-Results: mail.protonmail.ch; arc=none smtp.remote-ip=45.9.148.108
Authentication-Results: mail.protonmail.ch; dkim=none
X-Virus-Scanned: Debian amavis at shosting-s0-n1.nicevps.net
X-Amavis-Alert: BAD HEADER SECTION, Missing required header field: "Date"
Content-Type: text/html
Mime-Version: 1.0
From: support@npmjs.org
To: "franky47:npm"@francoisbest.com
Subject: Verify your account
Message-Id: <20250717222757.317BC628BA7@shosting-s0-n1.nicevps.net>
Date: Fri, 18 Jul 2025 00:27:57 +0200
X-Pm-Spam: 0yezJI6cihyJeYR3pi42biOzJFtcGiiwIcVns6ISZjI2YY1MTjWFOMAjxjBDZmNkVA0M
j1WQMNISsyNnIWaiQI2Oi5DcONkzwlZmYzMhBEwNGjWFMNFDmikzMfX0=
X-Pm-Origin: external
X-Pm-Transfer-Encryption: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
X-Pm-Content-Encryption: on-delivery
X-Pm-Spamscore: 0
X-Pm-Spam-Action: spam
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment