Security researchers at OX Security have identified 24 npm packages that exist solely to host phishing redirect pages disguised as Cloudflare Turnstile verification screens, exploiting the way mirror services like unpkg and npmmirror expose individual package files directly in a browser, according to BleepingComputer.
How the Technique Works
Attackers upload npm packages containing nothing more than a malicious HTML file and a package.json file declaring it as the main entry point. Because mirroring platforms such as unpkg.com let individual files inside a published package be opened directly through a browser URL, the malicious HTML renders as though it were served from a trusted, legitimate domain rather than from attacker-controlled infrastructure — a distinction that can help the page evade security software trained to flag suspicious hosts. Installing the package itself causes no harm; the payload is the standalone HTML file, not executable code bundled with the package.
Security researcher inf0stache first spotted the technique in July 2026 in a package named “china_airlines,” which used a fake Cloudflare verification page to redirect visitors to a malicious domain. OX Security subsequently found the same HTML template reused across 24 separate packages. Some of the malicious packages reference api.keyval.org, allowing operators to change the ultimate redirect destination remotely without needing to publish a new version of the package. OX also warned that packages removed from the official npm registry can persist indefinitely on third-party mirrors, meaning takedown at the source does not guarantee the malicious content disappears.
Part of a Broader Pattern
The campaign echoes an earlier technique documented by Socket in October 2025, when researchers found 175 malicious npm packages — collectively downloaded more than 26,000 times — using unpkg to host redirect scripts rather than full phishing pages, targeting Microsoft 365 accounts that lacked multi-factor authentication. “Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data,” OX Security concluded. For organizations relying on npm and its mirrors as part of their software supply chain, the finding underscores that package registries have become a persistent target for abuse well beyond traditional malicious-dependency attacks.
Leave a Reply