Published on August 26, 2026
Hackers Abuse npm Mirrors to Host Phishing Redirect Pages
Severity
Medium
Detail
Threat actors are abusing the npm package ecosystem and third-party npm mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHA verification screens and redirect users to attacker-controlled destinations.
At the time of analysis, some redirect chains were observed leading to legitimate websites; however, researchers noted that the mechanism could be reconfigured to direct users to phishing pages, ClickFix-style attacks, malware delivery sites, or other malicious destinations. Rather than using the packages to infect developers who install them, attackers are exploiting npm and mirrors such as UNPKG and npmmirror as legitimate, trusted infrastructure for hosting phishing-related content.
Platforms such as UNPKG and npmmirror allow individual files within npm packages to be accessed directly through a web browser, effectively enabling attackers to use npm mirrors as free web hosting services. Content served from trusted domains such as unpkg.com may be less likely to be blocked or flagged by users and security tools than content hosted on newly registered or known-malicious domains.
How?
The attack begins with a malicious npm package containing a minimal set of files, typically an index[.]html page and a package[.]json file identifying the HTML file as the package’s main file.
When the package is mirrored by services such as UNPKG, the malicious HTML becomes directly accessible through the mirror’s legitimate domain. A visitor accessing the file receives a fake Cloudflare security verification page containing the legitimate Cloudflare Turnstile CAPTCHA service. After the page is loaded, heavily obfuscated JavaScript executes and redirects the visitor to an externally controlled destination, regardless of the CAPTCHA outcome.
Earlier versions of the campaign redirected users to attacker-controlled domains, including Microsoft-themed typosquat domains.
Newer versions use api[.]keyval[.]org, a legitimate key-value storage service to retrieve an encrypted redirect value.
The browser decrypts the retrieved value and uses it as the destination URL. This allows threat actors to change the final redirect destination remotely without modifying or republishing the npm package.
The technique could therefore be used to redirect visitors to phishing pages, fake login portals, malware downloads, ClickFix-style attacks, or other attacker-controlled content. An additional concern is persistence. npm packages may remain available on mirror services even after they have been removed from the official npm registry, extending the lifetime of malicious content.
Conclusion
This campaign demonstrates how threat actors are increasingly abusing legitimate developer infrastructure for phishing and redirection rather than directly delivering malware through software packages. The use of npm mirrors provides attackers with trusted domains, established infrastructure, and potentially persistent access to malicious HTML. Security controls that rely primarily on domain reputation may be less effective against these campaigns because the initial content is hosted on legitimate package distribution infrastructure.
Organizations should treat unexpected direct HTML requests to npm registry and mirror domains as potentially suspicious, particularly when the content initiates redirects, executes heavily obfuscated JavaScript or presents unexpected authentication or CAPTCHA pages.
Source