- Researchers uncovered 24 npm packages that host malicious HTML pages mimicking Cloudflare CAPTCHAs.
- The packages are used as free storage on npm mirrors like unpkg, turning trusted domains into phishing hosts.
- Attackers switched from a typosquatted Microsoft domain to a legitimate key-value store to remotely control redirects.
- Installing the packages does not infect developers; the threat lies in visiting the hosted HTML pages.
Cybersecurity researchers have shed light on a novel campaign that leverages the npm ecosystem and its mirror services as free, trusted infrastructure for hosting phishing pages. A cluster of 24 npm packages, each containing a single HTML file, has been found to impersonate Cloudflare’s CAPTCHA verification screen. When these files are accessed through npm mirrors like unpkg, they render on legitimate domains, tricking visitors into believing they are interacting with a trusted service before being redirected to attacker-controlled destinations.
This approach marks a departure from typical supply-chain attacks, where malicious code is designed to infect developers who install a package. Instead, the threat actors are using npm and its mirrors as a safe, validated storage medium for their phishing payloads. As OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko explained, the malware is simply an HTML page inside the package, and downloading it wouldn’t cause direct harm. The real danger lies in the fact that the package’s content can be served directly from trusted domains, bypassing security measures that might otherwise block malicious sites.
How the Attack Works
The malicious packages, which include names like bgzxcuite2, prezdentkxheiw, and ndmxchdjxn2, are automatically mirrored by services such as unpkg, yarn, npmmirror, and Tencent. Some of these mirrors allow individual files within a package to be accessed directly in a browser. For instance, a URL like unpkgcom/ndmxchdjxn2@1.0.0/index.html renders the attacker’s HTML page on the legitimate unpkg domain. This page displays a fake Cloudflare verification prompt, complete with a real Turnstile CAPTCHA widget, but regardless of whether the user completes the CAPTCHA, heavily obfuscated JavaScript executes and redirects the visitor to an external site.
BleepingComputer examined one of these packages and confirmed that it contained only two files: an index.html and a package.json that declared the HTML as the main file. When accessed via UNPKG, the page indeed presented a fake CAPTCHA and then redirected to a domain that was not live at the time of testing but could be used for credential harvesting or other malicious purposes. The researchers noted that the packages typically attracted between 50 and 300 weekly downloads before being removed, but the real impact comes from the number of visitors who might click on links to these hosted pages.
Evolution of the Redirect Mechanism
The campaign has evolved its redirect infrastructure over time. Early versions of the malicious HTML contacted a typosquatted Microsoft domain, loginmicrosoftelive, which was later added to Google Chrome’s Safe Browsing blocklist. In response, the threat actor switched to using api.keyvalorg, a legitimate public key-value store that allows developers to set and retrieve data via a REST API. This service is now used as a dead drop resolver (DDR), where the HTML page retrieves an encrypted value, decrypts it in the browser, and then redirects the visitor to the decrypted URL.
This approach gives the attackers the ability to change the final destination remotely without modifying or republishing the npm package. At the time of OX Security’s analysis, the remote logic was configured to redirect users to the legitimate ChatGPT website, but the researchers warned that it could easily be weaponized to deliver ClickFix attacks or other phishing domains. The use of a legitimate service like KeyVal makes detection more difficult, as the traffic appears to be going to a trusted API endpoint.
Implications and Recommendations
This campaign highlights a growing trend of abusing legitimate infrastructure for malicious purposes. Rather than relying solely on infecting developers, attackers are using package registries and their mirrors as free web hosting for phishing pages. The trusted domain in the browser does not guarantee that the content is safe, and security teams need to be aware of this vector. OX Security recommends treating unexpected HTML URLs hosted on npm mirror domains as potential phishing infrastructure, adding those URLs to phishing-detection and reputation-monitoring systems, and checking proxy and DNS logs for direct .html requests to mirror domains from within mirrored packages.
This is not the first time such techniques have been observed. In October 2025, Socket reported a campaign codenamed Beamglea that used 175 npm packages to host redirect scripts on unpkg’s CDN. The current campaign, however, stands out for its use of a key-value store as a dynamic redirect mechanism, making it more resilient to takedowns. As OX Security concluded, threat actors keep finding new ways to use legitimate infrastructure to store their payloads and data, and the persistence of npm packages on mirrors means that even after removal from the official registry, the malicious content may remain accessible for a long time.
Ultimately, this incident serves as a reminder that the software supply chain is not just about code execution but also about how trust is exploited. Developers and security professionals should remain vigilant when interacting with links that point to npm mirror domains, especially those that render HTML files directly. By understanding these tactics, organizations can better protect themselves against phishing and other web-based attacks that leverage trusted platforms.
