OX Security found 24 npm packages being used through unpkg mirrors to host fake Cloudflare CAPTCHA pages that redirect visitors to attacker-controlled sites. The packages are not trying to infect developers who install them; they are being used as free, validated web hosting for a phishing lure.
The trick is simple: a package contains an HTML page, and unpkg serves it on a trusted-looking domain. When someone opens the mirrored page, it looks like a Cloudflare check, then silently sends them onward to whatever site the attacker chose.
That changes cleanup. Blocking one phishing domain does not remove the lure if the page is still live in a package mirror, so any team that treats mirrored content as trusted web content inherits a slower, stickier takedown problem.
Hackers abuse npm mirrors to host phishing redirect pages
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.