Cybersecurity Risks Escalate as Hackers Abuse npm Mirrors for Phishing Redirects
In a disturbing trend that highlights the evolving tactics of cyber threat actors, hackers have been exploiting npm and its mirrors to host malicious HTML pages designed to impersonate Cloudflare CAPTCHAs. These phishing redirect pages are then used to divert visitors to attacker-controlled websites, raising concerns about the security of developer sites and the potential for data breaches.
The technique was first spotted in July by security researcher inf0stache, who identified a ‘china_airlines’ npm package that used a fake Cloudflare verification page to redirect visitors to a malicious domain. IntelFusions also reported similar findings, but it wasn’t until OX Security discovered 24 npm packages containing the same malicious HTML page hosted on npm and various mirrors that the full extent of the threat became clear.
Unlike traditional supply-chain attacks, which often involve installing malware or infostealers onto a developer’s computer, this technique relies on using the npm registry as free storage for malicious HTML pages. These pages are then copied by mirroring platforms like UNPKG and npmmirror, effectively turning these developer sites into web hosting services for phishing pages.
The attackers use the npm registry to store their malicious code, which is then accessed through individual files in npm packages that can be opened directly in a browser using a URL such as https://unpkg.com/ndmxchdjxn2@1.0.0/index.html. This allows the attackers to bypass security software and potentially evade detection.
The malicious HTML pages impersonate Cloudflare’s legitimate Turnstile CAPTCHA service, embedding it into the page without requiring actual verification. Regardless of whether the verification succeeds, the page executes heavily obfuscated JavaScript that redirects the visitor to another site. In some cases, these redirects resolve to legitimate websites, while in others they point to attacker-controlled destinations.
The researchers at OX Security warn that npm packages may remain on mirrors even after being removed from the official npm registry, allowing threat actors to keep finding and using new techniques to store their payloads and data. To mitigate this risk, developers should treat direct HTML requests to npm mirror domains as potentially suspicious, and organizations should consider implementing additional security measures to protect against phishing attacks.
Ultimately, this trend highlights the need for ongoing vigilance in cybersecurity, as threat actors continually adapt and evolve their tactics to evade detection. By staying informed about emerging threats and taking proactive steps to secure our infrastructure, we can reduce the risk of data breaches and ensure a safer online environment for everyone.
Source: Bleeping Computer — 2026-08-25