GoKawiilAttackers exploit npm mirrors like UNPKG to host fake Cloudflare CAPTCHA phishing pages
Researchers found threat actors uploading npm packages containing only a malicious HTML file disguised as a Cloudflare verification page. When mirrored by sites like UNPKG and npmmirror, these files become directly viewable in a browser under a trusted domain, redirecting victims to attacker-controlled sites. OX Security identified 24 such packages, following an earlier discovery in July involving a package called 'china_airlines'.