Cybercriminals have discovered a new way to use the npm package manager to host phishing redirect pages, exploiting a weakness in the system that allows them to store malicious HTML files on legitimate domains. This technique has been spotted in at least 24 packages, which were found to contain identical code that impersonates Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.
The attackers are not using npm to infect developers’ computers with malware or steal sensitive information. Instead, they are leveraging the registry as a free storage solution for their phishing pages, which are then copied by mirroring platforms like UNPKG and npmmirror. These platforms allow individual files in npm packages to be accessed directly in a browser, effectively turning developer sites into free web hosting for malicious content.
When a user visits one of these mirrored domains, they may not even realize that the HTML file is being served from a legitimate domain. The attackers use this technique to bypass security software and potentially evade detection by blocking malicious sites. According to OX Security, the npm-hosted HTML can be rendered in the browser using a URL such as https://unpkg.com/ndmxchdjxn2@1.0.0/index.html, which could lead visitors to a phishing page or other attacker-controlled destination.
The malicious HTML pages impersonate Cloudflare security verification pages that embed legitimate CAPTCHA services. Regardless of whether the verification succeeds, the page executes heavily obfuscated JavaScript that redirects the visitor to another site. The researchers have tracked the redirects to various domains, including microcloud[.]homes and api.keyval.org, which is a legitimate platform for storing key-value pairs.
The attackers have also been using a newer method that retrieves an encrypted value from api.keyval.org and decrypts it in the browser before redirecting the visitor to the decrypted URL. This allows them to change the redirect URL remotely without modifying or republishing the npm package.
While this technique is not as severe as traditional supply-chain attacks, which can infect developers’ computers with malware, it still poses a significant threat to users who visit these mirrored domains. The researchers recommend treating direct HTML requests to npm mirror domains as potentially suspicious and warn that npm packages may remain on mirrors even after being removed from the official registry.
In conclusion, this new technique highlights the evolving tactics of cybercriminals, who are finding creative ways to use legitimate infrastructure for malicious purposes. As a result, users should be vigilant when accessing npm mirror domains and take steps to protect themselves against phishing attacks.
Source: Bleeping Computer — 2026-08-25