24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
24 npm packages are being abused as free phishing infrastructure by hosting fake Cloudflare CAPTCHA pages on trusted mirrors like unpkg.com The campaign uses ClickFix-style social engineering to trick users into performing unintended actions that lead to malware deployment Threat actors pivot from blocked domains to legitimate services like KeyVal.org as dead drop resolvers (DDR) to dynamically control redirect URLs npm mirrors provide persistent, validated storage for malicious payloads that su
Analysis
TL;DR
- 24 npm packages are being abused as free phishing infrastructure by hosting fake Cloudflare CAPTCHA pages on trusted mirrors like unpkg.com
- The campaign uses ClickFix-style social engineering to trick users into performing unintended actions that lead to malware deployment
- Threat actors pivot from blocked domains to legitimate services like KeyVal.org as dead drop resolvers (DDR) to dynamically control redirect URLs
- npm mirrors provide persistent, validated storage for malicious payloads that survive removal from official registries
- This follows a pattern seen in the October 2025 Beamglea campaign, which abused 175 npm packages for similar CDN-based phishing redirection
Why It Matters
This campaign represents a significant shift in threat actor strategy—moving from traditional malware delivery to infrastructure abuse, leveraging trusted developer ecosystems as free, persistent hosting for phishing content. For AI practitioners and security professionals, it highlights how supply chain-adjacent attacks can bypass traditional security controls by exploiting the inherent trust developers place in package registries and CDN mirrors.
Technical Details
- Attack Vector: 24 npm packages (e.g.,
ndmxchdjxn2,bgzxcuite2,passport811) host a single HTML file containing a fake Cloudflare verification page with embedded JavaScript that communicates with remote servers - Infrastructure Abuse: Packages are published to npm and mirrored on unpkg.com, providing trusted-domain hosting (e.g.,
unpkg.com/ndmxchdjxn2@1.0.0/index.html) that bypasses domain reputation filters - Dead Drop Resolver (DDR): After initial typosquat domains (e.g.,
login.microsofte.live) were blocklisted by Google Chrome Safe Browsing, the actor switched toapi.keyval.org—a legitimate key-value store used to dynamically store and retrieve redirect URLs - Social Engineering: The fake CAPTCHA page uses ClickFix methodology, instructing users to perform actions (e.g., clicking through verification steps) that ultimately redirect them to malicious or weaponized destinations
- Persistence: npm packages remain accessible on mirrors indefinitely even after removal from official registries, creating long-lived phishing infrastructure
Industry Insight
- Supply Chain Security Gap: Organizations should treat npm mirrors as potential attack surfaces; security teams should monitor for unusual HTML content served from package registry CDNs, not just malicious code in dependencies
- Dynamic Infrastructure is the New Normal: The shift to DDRs like KeyVal demonstrates how threat actors are decoupling payload hosting from command-and-control, making takedowns less effective—security tools need to detect behavioral patterns rather than relying on static blocklists
- Developer Awareness: The campaign exploits the trust developers place in npm infrastructure; security training should emphasize that published packages can be weaponized as phishing vectors even without malicious installation behavior
Disclaimer: The above content is generated by AI and is for reference only.