Hackers abuse npm mirrors to host phishing redirect pages
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.
Intelligence analysis by Llama
Hackers are using npm mirrors as free frontend hosts for malicious HTML pages, which can redirect visitors to phishing sites, malware downloads, or other attacker-controlled destinations.
Hackers are using a website called npm to host fake security pages that trick people into visiting other websites. These fake pages look like real security checks, but they actually redirect people to bad websites. This is like a phishing attack, but instead of sending emails, hackers are using the npm website to trick people into visiting bad websites.
Analysis
npm Mirrors as Free Frontend Hosts for Malicious HTML Pages
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. This technique was previously spotted in July by security researcher inf0stache, who found a 'china_airlines' npm package that used a fake Cloudflare verification page to redirect visitors to a malicious domain, and was also reported by IntelFusions.
In a later report, OX Security discovered 24 npm packages containing the same malicious HTML page hosted on npm and various mirrors. However, unlike the typical npm supply-chain attacks we've seen lately, installing the packages does not infect a developer's computer with malware or infostealers. Instead, attackers use the npm registry as free storage for malicious HTML pages, which are then copied by mirroring platforms like UNPKG and npmmirror.
Because some of these platforms let individual files in npm packages be accessed directly in a browser, they effectively turn these developer sites into free web hosting for phishing pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor's use of npm isn't to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware," explains OX Security.
BleepingComputer examined one of the packages identified in the campaign and found that it contained only two files, an index.html page and a package.json file that declared the HTML file as the package's main file.
npm package containing an index.html and package.json file
Source: BleepingComputer
When UNPKG mirrors the package, the HTML file can be opened directly in a browser using a URL such as https://unpkg[.]com/ndmxchdjxn2@1.0.0/index[.]html. This causes the attacker's HTML to be rendered in the browser from the legitimate unpkg.com domain rather than from infrastructure controlled by the threat actor, potentially bypassing security software that may have blocked a malicious site.
OX says this technique effectively turns npm mirrors into "free frontend hosts for malicious HTML pages and potentially other payloads as well." Malicious HTML acts as a redirector
The malicious HTML impersonates a Cloudflare security verification page that embeds Cloudflare's legitimate Turnstile CAPTCHA service.
Malicious HTML page loaded from UNPKG
Source: BleepingComputer
Regardless of whether the verification succeeds, the page executes heavily obfuscated JavaScript that redirects the visitor to another site. OX Security research team lead Moshe Siman Tov Bustan told BleepingComputer that earlier versions redirected to microcloud[.]homes in July and login[.]microsofte[.]live in August.
The researchers said some of the earliest July redirects ultimately resolved to the legitimate Microsoft Outlook mail login site (https://outlook.office.com/mail). BleepingComputer tested one of the malicious pages hosted through UNPKG and confirmed that it still redirects visitors to that domain.
This domain is not currently live, but it may be used to host a fake Microsoft login page. The researchers say other packages switched to a different redirect method that uses api.keyval.org, a legitimate platform for storing key-value pairs.
According to the researchers, the newer code retrieves an encrypted value from the service, decrypts it in the browser, and then redirects the visitor to the decrypted URL. This lets the attackers change the redirect URL remotely without modifying or republishing the npm package.
At the time of OX's research, the remotely configured destination redirected visitors to the legitimate ChatGPT website. While OX says the value could be changed at any time to point to ClickFix or other phishing pages, the npm-hosted HTML reviewed by BleepingComputer does not perform a ClickFix attack.
These pages could also redirect visitors to phishing pages, malware downloads, or other attacker-controlled destinations.
OX also warns that npm packages may remain on mirrors after being removed from the official npm registry.
"Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data," concluded OX.
The researchers recommend treating direct HTML requests to npm mirror domains as potentially suspicious.
Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
Key points
- Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.
- The malicious HTML pages are hosted on npm and its mirrors, and can be accessed directly in a browser using a URL such as https://unpkg[.]com/ndmxchdjxn2@1.0.0/index[.]html.
- The attackers use the npm registry as free storage for malicious HTML pages, which are then copied by mirroring platforms like UNPKG and npmmirror.
- The malicious HTML pages impersonate a Cloudflare security verification page that embeds Cloudflare's legitimate Turnstile CAPTCHA service.
- The page executes heavily obfuscated JavaScript that redirects the visitor to another site.
- The attackers use a legitimate platform for storing key-value pairs, api.keyval.org, to change the redirect URL remotely without modifying or republishing the npm package.
- The researchers recommend treating direct HTML requests to npm mirror domains as potentially suspicious.
If developers and security researchers work together to identify and remove these malicious packages, it could help prevent future phishing attacks and keep people safer online.
However, the fact that hackers are using legitimate infrastructure to store their payloads and data makes it harder to detect and prevent these attacks. This could lead to more people falling victim to phishing attacks and compromising their security.
