OX Security found 24 npm packages being used through unpkg mirrors to host fake Cloudflare CAPTCHA pages that redirect visitors to attacker-controlled sites. The packages are not trying to infect developers who install them; they are being used as free, validated web hosting for a phishing lure.
The trick is simple: a package contains an HTML page, and unpkg serves it on a trusted-looking domain. When someone opens the mirrored page, it looks like a Cloudflare check, then silently sends them onward to whatever site the attacker chose.
That changes cleanup. Blocking one phishing domain does not remove the lure if the page is still live in a package mirror, so any team that treats mirrored content as trusted web content inherits a slower, stickier takedown problem.