# Hackers Abuse npm Mirrors to Host Phishing Redirects

> Threat actors exploit npm and its mirroring platforms like UNPKG to host malicious HTML pages, impersonating Cloudflare CAPTCHAs for phishing redirects.

- Published: 2026-08-26T08:31:38.000Z
- Severity: medium
- Category: Supply Chain
- Tags: NPM, Phishing, Supply Chain Attack, UNPKG, Cloudflare Impersonation
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages/
- Canonical: https://runtimerebel.com/blog/hackers-abuse-npm-mirrors-to-host-phishing-redirects

## Key points

- Attackers leverage npm mirrors to host deceptive Cloudflare CAPTCHA pages, redirecting users to phishing sites.
- Users interacting with malicious URLs served from npm mirror domains like UNPKG are at risk of phishing.
- Treat direct HTML requests to npm mirror domains as highly suspicious and implement robust phishing defenses.

## Hackers Abuse npm Mirrors for [Phishing](/glossary#phishing) Redirects

Threat actors are actively exploiting the npm package registry and its mirroring platforms, such as UNPKG and npmmirror, to host malicious HTML pages that impersonate Cloudflare CAPTCHAs. This novel technique effectively turns legitimate developer infrastructure into free, trusted web hosting for phishing redirect pages, potentially bypassing traditional security defenses that might block attacker-controlled domains. This ongoing campaign represents a clever abuse of widely used developer resources for nefarious purposes, demanding heightened vigilance from security professionals.

## Technical Details: How Attackers Leverage npm Infrastructure

Unlike typical npm supply chain attacks that aim to infect a developer's machine upon package installation, this campaign utilizes npm solely for storage and distribution of malicious HTML. Researchers first spotted this technique in July, identifying a `china_airlines` npm package that hosted a fake Cloudflare verification page designed to redirect visitors to a malicious domain, as reported by [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages/). Subsequently, OX Security uncovered 24 additional npm packages containing similar malicious HTML pages hosted across npm and its mirrors.

The core of the attack lies in the fact that mirroring platforms like UNPKG allow direct browser access to individual files within npm packages. For instance, a malicious `index.html` file within an npm package named `ndmxchdjxn2@1.0.0` can be rendered directly via a URL such as `https://unpkg[.]com/ndmxchdjxn2@1.0.0/index[.]html`. This means the malicious HTML page is served from a legitimate domain (`unpkg.com`), lending it an air of trustworthiness and potentially allowing it to circumvent security software that flags known malicious IP addresses or domains. OX Security aptly describes this as turning npm mirrors into "free frontend hosts for malicious HTML pages."

The malicious HTML itself is designed to impersonate a Cloudflare security verification page, embedding Cloudflare's legitimate Turnstile CAPTCHA service. While the CAPTCHA might function normally, the page also contains heavily obfuscated JavaScript. This script's primary function is to redirect the user to an attacker-controlled site, regardless of whether the CAPTCHA challenge is successfully completed. Early versions of these redirects, observed in July, pointed to `microcloud[.]homes`, while August saw redirects to `login[.]microsofte[.]live`. Some initial redirects ultimately resolved to the legitimate Microsoft Outlook mail login site, suggesting a [reconnaissance](/glossary#reconnaissance) or credential-phishing motive.

A more sophisticated redirection method observed by researchers involves `api.keyval.org`, a legitimate platform for storing key-value pairs. This allows attackers to store an encrypted redirect URL, which is then decrypted and executed by the malicious HTML in the user's browser. This technique provides a critical advantage for attackers: the ability to remotely change the destination URL without needing to modify or republish the npm package itself. This flexibility enables attackers to quickly adapt their campaigns, pointing users to new phishing pages, [malware](/glossary#malware) downloads, or other malicious destinations as needed. At the time of OX's research, some packages were redirecting to the legitimate ChatGPT website, though this could be changed at any moment to point to [credential harvesting](/glossary#credential-harvesting) or other nefarious pages.

One significant challenge in **mitigating npm hosted phishing pages** is the [persistence](/glossary#persistence) of these malicious files. OX Security warns that even if an npm package is removed from the official registry, its mirrored copies on platforms like UNPKG may persist, remaining accessible and capable of serving malicious content for an extended period. This highlights a critical oversight in how these mirroring services handle content removal and reinforces the difficulty in containing such attacks.

## Actionable Recommendations for Detecting npm Mirror Phishing Redirects

Organisations and individuals should be aware of this evolving threat and take proactive steps to protect against it. The primary goal for defenders is to identify and block these redirects before they can lead to compromise.

*   **Exercise Extreme Caution with Unexpected Links:** Users should be highly suspicious of any unsolicited links, especially those promising security verification, even if they appear to originate from seemingly legitimate domains like `unpkg.com`. Always verify the full URL and, if prompted for credentials, navigate directly to the service's official website instead of clicking through links.
*   **Enhanced Network Filtering:** Security teams should consider implementing advanced web filtering rules that flag or block direct HTML requests to npm mirror domains (e.g., `unpkg.com`, `npmmirror.com`) that are not part of an expected development workflow. While npm mirrors are legitimate resources for developers, direct access to arbitrary HTML files hosted on them should be viewed with suspicion. This is a key step for **detecting npm mirror phishing redirects**.
*   **Employee Training:** Conduct regular [security awareness training](/glossary#security-awareness-training) emphasizing the dangers of phishing, particularly techniques that leverage legitimate infrastructure. Employees should be trained to scrutinize URLs, identify common phishing indicators, and report suspicious activities.
*   **Email Security Gateway Configuration:** Ensure email security gateways are configured to detect and quarantine emails containing links to known or suspicious npm mirror URLs that host potentially malicious content. Pay close attention to URLs that may appear benign due to their `unpkg.com` or `npmmirror.com` origins.
*   **Monitor for Compromised Credentials:** Given the potential for credential harvesting, organisations should continuously monitor for signs of compromised user accounts and enforce strong authentication practices, including multi-factor authentication ([MFA](/glossary#mfa)).

By understanding the mechanics of this npm mirror abuse and implementing these recommendations, security professionals can better defend against this sophisticated phishing technique.

**Related:** [NastyC2 npm Packages, AI Abuse & macOS Threats Identified](/blog/nastyc2-npm-packages-ai-abuse-macos-threats-identified), [npm Supply Chain Attacks: Shai-Hulud, Miasma, and CI/CD Compromises](/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromises)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/hackers-abuse-npm-mirrors-to-host-phishing-redirects