24 Malicious npm Packages Abuse Unpkg and Other Mirrors to Host Fake Cloudflare CAPTCHA Pages
OX Security found 24 npm packages built solely to let mirrors like unpkg serve fake Cloudflare CAPTCHA pages that can redirect to ClickFix-style phishing.
Overview
Security researchers have identified a campaign that abuses the npm package registry not to plant malware inside installed dependencies, but to turn the registry’s own content-delivery mirrors into free, trusted-looking hosting for phishing pages. According to OX Security, the firm’s research “found a total of 24 packages containing the same HTML page,” each one built to be mirrored rather than installed. The Hacker News describes the campaign as using “a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages,” and BleepingComputer reports that the threat actors are abusing “npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.”
What We Know
The mechanism relies on how third-party mirror services handle npm packages. According to OX Security, “Some of them are exposing the package files directly on their servers, not just the package’s ‘tgz’ zip” — meaning individual files inside a published package become directly browsable web pages once a mirror ingests them. The Hacker News illustrates the effect: “Once mirrored on these services, the HTML file (e.g., “unpkg[.]com/ndmxchdjxn2@1.0.0/index.html”) becomes a live, fully-rendered fake Cloudflare CAPTCHA page that’s hosted on a trusted domain but redirects to attacker-controlled phishing infrastructure that could enable ClickFix attacks or credential harvesting.”
BleepingComputer independently examined the packages and found the structure was deliberately minimal: “BleepingComputer examined one of the packages identified in the campaign and found that it contained only two files, an index.html page and a package.json file that declared the HTML file as the package’s main file.” No installable code, no dependency payload — just a static phishing page designed to be served by the mirror.
The campaign’s redirect infrastructure evolved over time. BleepingComputer reports that OX Security researcher Moshe Siman Tov Bustan “told BleepingComputer that earlier versions redirected to microcloud[.]homes in July and login[.]microsofte[.]live in August,” both typosquats designed to look like Microsoft domains. The technique itself predates the packages OX Security found: BleepingComputer notes “The technique was previously spotted in July by security researcher inf0stache, who found a ‘china_airlines’ npm package that used a fake Cloudflare verification page to redirect visitors to a malicious domain.”
A second wave of packages shifted to a more flexible mechanism. OX Security found that later versions used “a different domain name – https://api.keyval.org – a legitimate domain used to store key-value pairs, which the threat actor is using to get an encrypted value” that determines where visitors are redirected — allowing the attackers to change destinations without republishing new npm packages. As of OX Security’s research, “Currently the remote logic transfers the user to the legitimate ChatGPT website,” though the redirect target is attacker-controlled and can be changed at any time.
OX Security’s researchers, Moshe Siman Tov Bustan and Vitalii Chepurko, summarized the strategy behind the campaign: “the threat actor’s use of npm isn’t to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware,” they said, according to both OX Security’s own writeup and The Hacker News. BleepingComputer separately quoted the researchers’ broader conclusion: “Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data.”
The Hacker News also placed the campaign in context of past abuse of the same mirror infrastructure: “In October 2025, Socket detailed a set of 175 npm packages that used unpkg.com’s content delivery network (CDN) to host redirect scripts that routed victims to credential harvesting pages as part of a campaign codenamed Beamglea.”
The Hacker News notes that some of the 24 packages identified in this campaign remain “available for download” as of its report, indicating not all had been removed from the registry or its mirrors at publication time.
What We Don’t Know
None of the three sources report a public statement from npm, its parent GitHub, or Cloudflare responding to the findings, nor do they cite a CVE or formal security advisory number for the campaign. It is also not established how many people were exposed to the fake CAPTCHA pages, since the attack does not rely on developers installing the packages as dependencies — victims would only encounter the pages if directed to the mirrored URLs directly, for example through search results, ads, or other phishing lures pointing at the trusted mirror domains.
Analysis
The campaign is notable less for its payload — a single static HTML page — than for what it exploits: the reputational trust attached to package-registry mirror domains. Because unpkg, npmmirror, and similar services are widely used by developers and are rarely blocked by security filters, a phishing page served from one of those domains can bypass reputation-based defenses that would flag a freshly registered phishing domain. The shift toward an external “dead drop” resolver like api.keyval.org compounds that advantage, letting attackers change where victims land without touching the npm package itself, and without leaving a trail in the registry’s own version history.