npm Mirrors Turned into Phishing Hosts

Threat actors have found a way to turn the npm package registry and its public mirrors into free, legitimate-looking web hosts for phishing pages. By storing a single malicious HTML file inside an npm package, they can serve it directly from domains like unpkg.com, bypassing security tools that might block a typical attacker-controlled site. The campaign, which researchers say has been active since at least July, abuses the trust placed in well-known developer infrastructure.

Fake Cloudflare CAPTCHA Pages

The malicious HTML disguises itself as a Cloudflare CAPTCHA verification page, a common sight for users on the web. It even embeds Cloudflare's legitimate Turnstile CAPTCHA service to make the ruse more convincing. But regardless of whether the user completes the verification, the page runs heavily obfuscated JavaScript that redirects visitors to another site.

The technique first came to light in July when security researcher inf0stache found an npm package named 'china_airlines' that used this fake Cloudflare page to redirect visitors to a malicious domain. The finding was also reported by IntelFusions. Later, OX Security expanded on this discovery, identifying 24 npm packages containing the same malicious HTML page.

Not a Typical Supply-Chain Attack

Unlike most npm supply-chain attacks, installing these packages does not infect a developer's computer with malware or infostealers. Instead, the attackers are using the npm registry as a free storage service for malicious HTML pages. The packages themselves are harmless to download; the danger comes when the HTML is viewed in a browser.

Mirroring platforms like UNPKG and npmmirror copy the packages automatically. Because these platforms permit individual files within a package to be accessed directly in a browser, they effectively become, in the words of OX Security, "free frontend hosts for malicious HTML pages and potentially other payloads as well."

How the Redirect Works

BleepingComputer examined one of the packages identified in the campaign and found it contained only two files: an index.html page and a package.json file that declared the HTML file as the package's main file. When UNPKG mirrors the package, the HTML file can be opened directly in a browser using a URL like .

This causes the attacker's HTML to be rendered from the legitimate unpkg.com domain rather than from threat actor-controlled infrastructure. This approach could bypass security software that might have blocked a known malicious site, since unpkg.com is a trusted, widely used domain in the developer ecosystem.

Remote Configuration

OX Security researcher Moshe Siman Tov Bustan told BleepingComputer that earlier versions of the malicious pages redirected to microcloud[.]homes in July and login[.]microsofte[.]live in August. Some of the earliest July redirects ultimately resolved to the legitimate Microsoft Outlook mail login site ().

BleepingComputer tested one of these malicious pages hosted through UNPKG and confirmed it still redirects visitors to that domain. The domain is not currently live, but it may be used to host a fake Microsoft login page. The researchers also noted that other packages switched to a different redirect method using api.keyval.org, a legitimate platform for storing key-value pairs.

This newer method retrieves an encrypted value from the service, decrypts it in the browser, and then redirects the visitor to the decrypted URL. This allows the attackers to change the redirect destination remotely without modifying or republishing the npm package, making the attack more flexible and harder to track.

Potential for ClickFix and Other Threats

At the time of OX's research, the remotely configured destination redirected visitors to the legitimate ChatGPT website. While OX says the value could be changed at any time to point to ClickFix or other phishing pages, the npm-hosted HTML reviewed by BleepingComputer does not perform a ClickFix attack.

The pages could also redirect visitors to phishing pages, malware downloads, or other attacker-controlled destinations. The flexibility of the remote configuration means the same package could be repurposed for different attacks at any time.

Persistent Packages

OX also warns that npm packages may remain on mirrors even after being removed from the official npm registry. This means that even if the packages are taken down from npm, they could continue to be hosted on mirrors, prolonging the life of the phishing pages.

"Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data," concluded OX. The researchers recommend treating direct HTML requests to npm mirror domains as potentially suspicious.

Why It Matters

The abuse of npm mirrors as free hosting for phishing pages is a reminder that attackers continuously seek out legitimate infrastructure to lend credibility to their schemes. By leveraging trusted domains like unpkg.com, they can evade security filters that rely on domain reputation, and the remote configuration capability means the same package can be repurposed on the fly. For defenders, this suggests that monitoring for malicious packages is not enough — they must also be alert to the possibility that a trusted developer platform is being used to serve phishing content, and that takedowns may need to extend to mirror platforms to be effective.