Threat actors are repurposing the npm registry and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs. This technique bypasses traditional security by leveraging legitimate domains to redirect users to phishing sites.

  • Attackers are using npm and its mirrors (like UNPKG) as free web hosting for phishing content.
  • The method impersonates legitimate Cloudflare CAPTCHA services to deceive users.
  • Unlike supply-chain attacks, this targets end-users via browser redirects rather than infecting developer machines.
  • Attackers can remotely change redirect destinations using legitimate key-value storage services.

A sophisticated new phishing technique has emerged where threat actors are abusing the npm (Node Package Manager) registry and its various mirrors. Instead of the traditional supply-chain attack aimed at infecting a developer's workstation with malware, these attackers are using npm as a high-reputation, 'free' hosting service for malicious HTML pages.

The Mechanics of the Attack

Security researchers at OX Security have identified dozens of npm packages designed specifically to host malicious code. When these packages are mirrored by platforms such as UNPKG or npmmirror, the HTML files within them can be accessed directly through a browser. Because these files are served from legitimate domains like unpkg.com, they often bypass security filters that would otherwise block known malicious URLs.

Read Also:National Space Day: PM Modi Hails India's Space Journey; Leaders Salute Chandrayaan-3 Success

Why This Matters

BozokMedia analysis shows that this method effectively turns developer-centric infrastructure into a weapon for social engineering. The malicious HTML is crafted to look identical to a Cloudflare Turnstile CAPTCHA. Once a victim interacts with the page, heavily obfuscated JavaScript executes, redirecting the user to an attacker-controlled site—often a fake login page for services like Microsoft or ChatGPT.

Threat actors continue to find novel ways to use legitimate infrastructure to store their payloads and data, making detection significantly harder.

One of the most dangerous aspects of this campaign is the use of api.keyval.org. By retrieving encrypted values from this legitimate service, attackers can change the destination URL of their phishing redirect remotely, without ever having to modify or republish the original npm package.

Historical Context and Persistence

This trend was first noted in July with packages like 'china_airlines' and has since evolved. A critical concern raised by researchers is that even if a malicious package is removed from the official npm registry, it may persist on various mirrors, providing a long-term window for attackers to exploit.

Did You Know?: Because the content is hosted on trusted domains, many automated security tools view these redirects as legitimate traffic.

Frequently Asked Questions

Question 1: Does installing these npm packages infect my computer?
Generally, no. The primary goal is not to infect the developer, but to use the registry as a storage medium for hosting phishing pages that target web visitors.

Question 2: How can I protect myself?
Treat direct HTML requests to npm mirror domains as suspicious and always verify the URL in your browser's address bar before entering credentials.