Attackers are uploading npm packages that do not infect developers directly but instead use npm mirrors as free hosting for fake Cloudflare verification pages. OX Security found at least 24 packages containing malicious HTML that can be opened directly from mirror domains such as UNPKG and npmmirror, then run obfuscated JavaScript to redirect visitors to attacker-chosen sites, including domains linked to Microsoft-themed phishing; some variants fetch encrypted redirect targets from api.keyval.org so operators can change destinations without republishing the package.
Why it matters: This matters because trusted developer infrastructure is being repurposed to make phishing pages look safer and harder to block. Defenders should hunt for links to npm mirror-hosted HTML pages, block known package URLs, and warn users that Cloudflare-style verification pages on unexpected domains may be phishing lures.
Lawrence Abrams
2026.08.25
100% relevant
This article establishes a distinct campaign in which attackers misuse npm registry mirrors as hosting infrastructure for phishing redirect pages, rather than compromising packages to execute malware during installation.
← Back to all stories