Cybersecurity researchers recently identified a targeted five-month spear-phishing campaign that utilized 27 malicious npm packages to steal credentials from critical infrastructure organizations.