24 npm packages use unpkg mirrors for fake Cloudflare CAPTCHA pages
Cybersecurity researchers have identified a campaign involving 24 npm packages that abuse unpkg mirrors to host fully rendered fake Cloudflare CAPTCHA pages. The pages redirect visitors to ClickFix-style phishing infrastructure, using a trusted package-mirror domain as the initial delivery location.
OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko said the packages are not designed to infect developers who download them. Each contains a single HTML page, and the operators’ objective is to use the npm registry and its mirrors as validated storage and hosting infrastructure for the page.
Trusted mirrors used as phishing delivery infrastructure
When a package is mirrored through unpkg, its HTML file can be loaded directly in a browser. OX Security cited an example path for the package ndmxchdjxn2 at version 1.0.0. The resulting page presents a bogus Cloudflare verification prompt before sending the target to an attacker-controlled external site.
The embedded HTML includes both the fake CAPTCHA logic and JavaScript that sends a request to a remote server. A visitor who follows a link to the mirrored content may therefore encounter a convincing verification screen hosted on a domain associated with a legitimate developer service, then be induced to take actions that could lead to malware deployment.
Redirect logic moved after browser blocking
Initial versions contacted login[.]microsofte[.]live, a typosquatted domain impersonating the Microsoft login service. After Google Chrome added that domain to its Safe Browsing blocklist, the operators changed the mechanism to use KeyVal, a public key-value service with a REST API.
In this design, KeyVal functions as a dead-drop resolver. The page retrieves a value, extracts and decodes the next redirect URL, and transfers the visitor onward. Researchers observed that the remote logic currently directs users to the legitimate ChatGPT website, while warning that the same configuration could instead point to ClickFix or other phishing destinations.
A recurring npm mirror abuse pattern
The campaign echoes a technique documented by Socket in October 2025, when 175 npm packages used unpkg.com’s content delivery network to host redirect scripts in the Beamglea credential-harvesting campaign. The new activity reinforces that package ecosystems can be abused not only for malicious dependencies but also for storage, redirection and persistence through mirrored content.
For businesses, npm mirror URLs should not be treated as inherently safe merely because they resolve through a familiar service. Security teams should investigate verification pages reached from package-hosting links, examine redirect chains, and watch for unexpected browser requests to public data services such as key-value stores.