AI Security AI安全 4h ago Updated 2h ago 更新于 2小时前 43

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages 24个npm包滥用unpkg镜像托管伪造Cloudflare验证码页面

24 npm packages are being abused as free phishing infrastructure by hosting fake Cloudflare CAPTCHA pages on trusted mirrors like unpkg.com The campaign uses ClickFix-style social engineering to trick users into performing unintended actions that lead to malware deployment Threat actors pivot from blocked domains to legitimate services like KeyVal.org as dead drop resolvers (DDR) to dynamically control redirect URLs npm mirrors provide persistent, validated storage for malicious payloads that su 24个npm包被滥用,利用unpkg等镜像托管假Cloudflare CAPTCHA页面作为网络钓鱼基础设施 攻击者将npm注册表作为免费、可信的存储来托管恶意HTML页面,而非直接通过包感染开发者 攻击流程:用户访问镜像链接 → 看到假验证页面 → 被重定向到攻击者控制的钓鱼网站 攻击者使用KeyVal服务作为dead drop resolver,动态获取重定向目标URL,规避安全检测 这是供应链攻击的新形式,利用合法基础设施的持久性和可信度进行恶意活动

62
Hot 热度
65
Quality 质量
55
Impact 影响力

Analysis 深度分析

TL;DR

  • 24 npm packages are being abused as free phishing infrastructure by hosting fake Cloudflare CAPTCHA pages on trusted mirrors like unpkg.com
  • The campaign uses ClickFix-style social engineering to trick users into performing unintended actions that lead to malware deployment
  • Threat actors pivot from blocked domains to legitimate services like KeyVal.org as dead drop resolvers (DDR) to dynamically control redirect URLs
  • npm mirrors provide persistent, validated storage for malicious payloads that survive removal from official registries
  • This follows a pattern seen in the October 2025 Beamglea campaign, which abused 175 npm packages for similar CDN-based phishing redirection

Why It Matters

This campaign represents a significant shift in threat actor strategy—moving from traditional malware delivery to infrastructure abuse, leveraging trusted developer ecosystems as free, persistent hosting for phishing content. For AI practitioners and security professionals, it highlights how supply chain-adjacent attacks can bypass traditional security controls by exploiting the inherent trust developers place in package registries and CDN mirrors.

Technical Details

  • Attack Vector: 24 npm packages (e.g., ndmxchdjxn2, bgzxcuite2, passport811) host a single HTML file containing a fake Cloudflare verification page with embedded JavaScript that communicates with remote servers
  • Infrastructure Abuse: Packages are published to npm and mirrored on unpkg.com, providing trusted-domain hosting (e.g., unpkg.com/ndmxchdjxn2@1.0.0/index.html) that bypasses domain reputation filters
  • Dead Drop Resolver (DDR): After initial typosquat domains (e.g., login.microsofte.live) were blocklisted by Google Chrome Safe Browsing, the actor switched to api.keyval.org—a legitimate key-value store used to dynamically store and retrieve redirect URLs
  • Social Engineering: The fake CAPTCHA page uses ClickFix methodology, instructing users to perform actions (e.g., clicking through verification steps) that ultimately redirect them to malicious or weaponized destinations
  • Persistence: npm packages remain accessible on mirrors indefinitely even after removal from official registries, creating long-lived phishing infrastructure

Industry Insight

  • Supply Chain Security Gap: Organizations should treat npm mirrors as potential attack surfaces; security teams should monitor for unusual HTML content served from package registry CDNs, not just malicious code in dependencies
  • Dynamic Infrastructure is the New Normal: The shift to DDRs like KeyVal demonstrates how threat actors are decoupling payload hosting from command-and-control, making takedowns less effective—security tools need to detect behavioral patterns rather than relying on static blocklists
  • Developer Awareness: The campaign exploits the trust developers place in npm infrastructure; security training should emphasize that published packages can be weaponized as phishing vectors even without malicious installation behavior

TL;DR

  • 24个npm包被滥用,利用unpkg等镜像托管假Cloudflare CAPTCHA页面作为网络钓鱼基础设施
  • 攻击者将npm注册表作为免费、可信的存储来托管恶意HTML页面,而非直接通过包感染开发者
  • 攻击流程:用户访问镜像链接 → 看到假验证页面 → 被重定向到攻击者控制的钓鱼网站
  • 攻击者使用KeyVal服务作为dead drop resolver,动态获取重定向目标URL,规避安全检测
  • 这是供应链攻击的新形式,利用合法基础设施的持久性和可信度进行恶意活动

为什么值得看

这篇文章揭示了npm生态系统中一个新兴的供应链攻击模式,攻击者不再直接通过包感染用户,而是利用镜像服务的可信度来托管钓鱼页面。这种"基础设施滥用"策略比传统恶意软件更难检测,因为它利用了开发者信任的CDN和注册表。

技术解析

  • 攻击者注册24个npm包,每个包包含一个HTML文件,托管在unpkg等镜像上(如unpkg.com/ndmxchdjxn2@1.0.0/index.html)
  • HTML页面嵌入假Cloudflare CAPTCHA验证逻辑和JavaScript,将用户重定向到攻击者控制的网站
  • 初始阶段使用typosquat域名(login.microsofte.live)模仿Microsoft登录页面,被Chrome Safe Browsing阻止后切换到KeyVal服务
  • KeyVal作为dead drop resolver,攻击者通过REST API动态配置重定向目标URL,实现灵活的攻击链控制
  • 当前重定向到合法ChatGPT网站,但可被武器化用于ClickFix或其他钓鱼域名

行业启示

  • 开源软件供应链安全需要重新评估,不仅要关注包本身的恶意代码,还要警惕包被用于托管外部钓鱼基础设施
  • 开发者应建立对npm镜像和CDN的信任边界,对来自第三方托管服务的重定向保持警惕
  • 安全厂商需要更新检测策略,从传统的恶意软件分析转向基础设施滥用检测

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全 Open Source 开源 Research 科学研究