A cluster of 24 npm packages isn’t aimed at developers who install them, OX Security researchers say. The attacker is using the registry and its mirrors as free, trusted hosting for a fake Cloudflare CAPTCHA page.
Each package holds a single HTML file. Once a mirror such as unpkg picks it up, a URL like unpkg[.]com/[email protected]/index.html serves a fully rendered fake verification page from a trusted domain, which then sends the visitor to attacker-controlled infrastructure. “While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn’t do harm, the threat actor’s use of npm isn’t to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware,” researchers Moshe Siman Tov Bustan and Vitalii Chepurko said, as The Hacker News reported.
A redirect the attacker can change at any time
Early versions of the page sent visitors to login[.]microsofte[.]live, a typosquat of Microsoft’s sign-in page. After Chrome’s Safe Browsing blocklist flagged that domain, the attacker moved the logic to KeyVal, a free public key-value store. The page now looks up its destination there, so KeyVal works as a dead-drop resolver. “Currently the remote logic transfers the user to the legitimate ChatGPT website, but it could be weaponized to deliver ClickFix or any other phishing domains when configured to by the attacker,” OX Security said. That means ClickFix lures, which talk victims into running commands themselves, and credential theft are possible but haven’t been seen yet.
The technique isn’t new. In October 2025, Socket described 175 npm packages, a campaign it called Beamglea, that used unpkg’s CDN to host redirect scripts leading to credential-harvesting pages. OX also warned that npm packages “can live forever in mirrors even after they are removed from the official stores.” Some of the 24 packages were still downloadable when The Hacker News published its report.
OX found each package usually reached between 50 and 300 weekly downloads before it was removed.
WebProNews is an iEntry Publication