24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Cybersecurity researchers have disclosed a phishing campaign that abuses the npm ecosystem in an unusual way.

Instead of focusing on malware execution directly through package installation, the attackers published 24 npm packages containing a single malicious HTML page. Once those packages were mirrored by services such as unpkg, yarn, npmmirror, and Tencent mirrors, the embedded HTML files became directly accessible through trusted mirror domains. This allowed the attackers to turn legitimate package delivery infrastructure into free phishing-page hosting. 【turn588055view0†L19-L21】

How the Attack Works

The campaign uses a simple but effective technique.

Each malicious npm package contains an HTML file. When that file is opened through a mirror URL, the user is shown a fake Cloudflare verification page. The page then runs JavaScript that contacts attacker-controlled infrastructure and redirects the victim to another destination. 【turn588055view0†L29-L33】

In other words, the real abuse is not the npm package installation itself. The threat actor is using the npm registry and its mirrors as a trusted content distribution layer for malicious web pages.

A mirror URL such as a direct index.html path on a trusted npm mirror can therefore act as a phishing entry point, even though the domain itself appears legitimate.

Installation Alone Is Not the Main Threat

An important clarification from the researchers is that installing the packages is not what directly compromises the victim.

The packages are not primarily designed to infect developers who run npm install. Instead, the packages act as containers for malicious HTML content that becomes reachable on package mirror sites. Victims are exposed when they open those hosted pages and follow the social-engineering flow. 【turn588055view0†L19-L21】【turn588055view0†L95-L97】

This distinction matters because the campaign is fundamentally an infrastructure abuse case rather than a traditional software-supply-chain compromise in which malicious code executes automatically during package installation.

Fake Cloudflare CAPTCHA and ClickFix Risk

The phishing pages impersonate Cloudflare verification prompts.

These fake CAPTCHA-style pages are designed to build trust and make the victim believe that a routine verification step is required before continuing. In similar ClickFix-style campaigns, the final objective is often to convince victims to perform actions that lead to:

• Malware execution
• Malicious script pasting
• Downloading a secondary payload
• Visiting credential-harvesting pages

Researchers said the current remote logic observed in the campaign was redirecting users to the legitimate ChatGPT website at the time of analysis, but the same mechanism could be reconfigured at any time to point to ClickFix malware delivery or phishing destinations instead. 【turn588055view0†L44-L47】

From Microsoft Typosquat to KeyVal

Researchers observed an evolution in the campaign.

Earlier variants sent requests to a typosquatted Microsoft-themed domain: login[.]microsofte[.]live. After that domain was blocked, the attackers shifted to using api.keyval.org, a legitimate public key-value service, as a dead drop resolver. 【turn588055view0†L37-L45】【turn588055view0†L82-L88】

This means the phishing page does not have to hardcode the final malicious destination. Instead, it can retrieve an encoded value from a legitimate service, decode it, and then redirect the victim.

That approach provides flexibility and makes the campaign more resilient because the attacker can change redirect targets without rebuilding the original HTML page.

Affected Packages

OX Security documented 24 malicious npm packages tied to this campaign.

The package list included names such as:

• bgzxcuite2
• prezdentkxheiw
• ndmxchdjxn2
• @worrisome/reutil
• mndsxcusiwlk1
• mobiwaefhxc3

Researchers categorized them into families associated with either the earlier Microsoft-typosquat logic or the newer KeyVal-based logic. Several packages had already been taken down, but many were still marked live at the time of publication. 【turn588055view0†L55-L81】

Why This Technique Is Dangerous

The campaign is dangerous because it abuses trusted infrastructure.

Users are generally trained to be suspicious of unknown domains. But in this case, the malicious HTML pages are reachable from domains associated with legitimate npm mirror services. That increases the chance that:

• Users trust the link
• Security tools assign lower risk
• Reputation-based filtering misses the threat
• Analysts underestimate the phishing potential of software delivery infrastructure

The phishing page itself is lightweight, and mirror services can continue serving content even after the original package is removed from the primary registry in some cases. This creates a persistence problem for defenders. 【turn588055view0†L91-L94】

Recommended Security Measures

Organizations should treat npm mirror infrastructure more carefully than before.

Recommended actions include:

• Treat mirror domains such as unpkg, npmmirror, yarn, and Tencent mirrors as potential phishing hosts when they are not being used for normal package retrieval.
• Add npm mirror URLs to phishing detection, web-filtering, and URL-reputation workflows.
• Monitor proxy, DNS, and web logs for direct requests to .html files hosted inside mirrored packages.
• Educate users that a trusted domain does not automatically mean that the hosted page is safe.
• Investigate suspicious “Cloudflare verification” prompts that appear from unexpected contexts.
• Block or review access to known IoCs such as login[.]microsofte[.]live and suspicious use of api.keyval.org when applicable. 【turn588055view0†L22-L26】【turn588055view0†L82-L88】