GoKawiilAttackers exploit npm mirrors like UNPKG to host fake Cloudflare CAPTCHA phishing pages
Researchers found threat actors uploading npm packages containing only a malicious HTML file disguised as a Cloudflare verification page. When mirrored by sites like UNPKG and npmmirror, these files become directly viewable in a browser under a trusted domain, redirecting victims to attacker-controlled sites. OX Security identified 24 such packages, following an earlier discovery in July involving a package called 'china_airlines'.
GoKawiil's interpretation of the reporting above, not reported fact.
This abuse doesn't rely on infecting developers who install the packages—it turns npm's trusted infrastructure into free, reputable web hosting for phishing content. Because the malicious pages load from legitimate domains like unpkg.com, they can evade security filters and appear more credible to victims, making detection and takedown harder for defenders.
- Attackers use npm packages purely as storage for phishing HTML, not to spread malware to developers.
- Mirrors like UNPKG and npmmirror inadvertently host these fake Cloudflare CAPTCHA pages under trusted domains.
- At least 24 malicious packages have been found using this redirect technique to bypass security filters.
Yubico YubiKey 5C NFC Security Key — Phishing pages that mimic Cloudflare checks rely on tricking you into handing over credentials, and a hardware security key shuts that down because it only authenticates to the real domain. The YubiKey 5C NFC works over USB-C or by tapping your phone, so you can lock down GitHub, npm, and email accounts everywhere you work. It's a simple, durable upgrade over app-based codes for developers who publish packages.
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-25
Published there as: “Hackers abuse npm mirrors to host phishing redirect pages”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.