Hackers Abuse npm Mirrors to Host Phishing Redirect Pages

Overview

Threat actors have found a novel abuse vector for the npm ecosystem: publishing malicious HTML packages to npm and its mirror registries that impersonate Cloudflare CAPTCHA verification pages. When a victim visits a URL hosting one of these packages — via a CDN-hosted npm mirror like unpkg.com, jsdelivr.net, or cdnjs.cloudflare.com — they see what appears to be a legitimate CAPTCHA challenge. Completing the fake verification silently redirects the victim to an attacker-controlled website.

The technique exploits the inherent trust users place in npm mirrors, which are widely used to serve JavaScript libraries and assets at scale. Hosting phishing content on these high-reputation domains helps bypass URL filtering and gives the redirect chain the appearance of legitimacy.

How the Attack Works

Step 1 — Package Publication

Attackers create npm packages consisting primarily of malicious HTML/JavaScript rather than legitimate JavaScript libraries. These packages contain a landing page that closely mimics a Cloudflare Turnstile CAPTCHA or hCaptcha widget.

Step 2 — CDN Hosting via npm Mirrors

Once published to npm, the package's contents become accessible via multiple CDN-backed npm mirrors:

https://unpkg.com/<malicious-package>@1.0.0/index.html
https://cdn.jsdelivr.net/npm/<malicious-package>@1.0.0/index.html

These URLs originate from high-reputation domains that security tools and corporate proxies typically allow-list.

Step 3 — Victim Lure

Attackers distribute the CDN-hosted URL via:

• Phishing emails with links appearing to lead to a document or download
• Malvertising — ad networks serving the CDN URL as a landing page
• QR codes in physical or digital media
• SEO poisoning — getting the mirror URL to rank in search results

Step 4 — Fake CAPTCHA and Redirect

The victim sees a convincing Cloudflare CAPTCHA-style page. Upon "completing" the verification:

// Simplified malicious redirect logic
document.querySelector('.cf-turnstile-btn').addEventListener('click', () => {
    window.location.href = 'https://attacker-controlled-site.xyz/payload';
});

The redirect destination can serve:

• Credential harvesting pages (fake Microsoft 365, Google login)
• Malware downloads (disguised as required software or browser updates)
• Tech support scams — fake alert pages designed to call fraudulent support numbers
• ClickFix pages — clipboard-hijacking prompts that trick users into running malicious PowerShell

Why npm Mirrors Are an Effective Vector

npm's open publishing model — a feature that made it the world's largest package registry — becomes a liability when abused for hosting non-code content. Unlike domain registration, npm package creation requires no identity verification and is effectively instant.

Mirror Persistence Problem

A particularly challenging aspect of this technique is mirror caching. When malicious content is removed from npm:

1. registry.npmjs.org — content deleted ✓
2. unpkg.com cache — may serve cached content for hours or days
3. cdn.jsdelivr.net cache — similarly delayed invalidation
4. Third-party mirrors (China, EU CDN nodes) — invalidation not guaranteed

This means takedown of the npm package does not immediately remove all attack surfaces — cached versions on mirror infrastructure may continue serving phishing content well after the originating package is removed.

Detection and Defense

For Security Teams

1. Block direct end-user access to npm CDN mirrors — Unless your organization explicitly uses unpkg.com or jsdelivr.net for development, consider blocking or proxying these domains in your web proxy/CASB.

2. Alert on redirects from npm CDN domains to unknown destinations — A user navigating from unpkg.com or jsdelivr.net to a non-npm-related domain is a strong signal of this technique.

3. Train users to recognize CAPTCHA abuse — Legitimate CAPTCHAs do not appear on npm CDN URLs. Any CAPTCHA encountered on a package mirror URL should be treated as suspicious.

4. Monitor phishing feeds for npm mirror URLs — Services like PhishTank, OpenPhish, and URLhaus increasingly track this technique.

For npm Users and Developers

1. Do not click links to npm CDN mirrors unless you explicitly expect a library — If someone shares a unpkg.com or jsdelivr.net link, verify it leads to a JavaScript file, not an HTML page.

2. Report suspicious packages immediately — Use npm report or email security@npmjs.com to report packages that appear to host HTML phishing content.

3. Audit your own packages — If you own npm packages, ensure they have not been compromised or typosquatted.

Suspicious URL Patterns

# Red flags — HTML content served from npm mirrors:
https://unpkg.com/<any-package>/index.html       ← HTML, not JS
https://cdn.jsdelivr.net/npm/<pkg>/captcha.html  ← explicit phishing indicator
https://unpkg.com/<pkg>@1.0.0/verify.html        ← "verify" pages from npm mirrors

Broader Supply Chain Implications

This attack joins a growing list of npm ecosystem abuses:

• Typosquatting — Packages with names similar to popular libraries
• Dependency confusion — Packages that shadow internal package names
• Malicious code injection — npm packages with embedded credential stealers
• HTML/non-code content abuse — This technique, using npm as a phishing host

Each abuse vector exploits the fundamental trust model of package registries: that content from a known, high-reputation registry can be served to end users safely. As threat actors continue to discover ways to weaponize this trust, security teams must apply the same scrutiny to CDN-hosted registry content as they do to any other user-facing web content.

Key Takeaways

1. npm mirrors are being used as phishing hosts — Malicious HTML packages impersonate Cloudflare CAPTCHAs to redirect victims
2. High-reputation domains bypass filters — unpkg.com and jsdelivr.net are routinely allow-listed, making detection harder
3. Cache persistence extends the attack window — Takedowns from npm do not immediately clear mirror caches
4. Block or proxy npm CDN access — Unless explicitly needed, end-user browsing to npm mirrors should be restricted
5. Train users — No legitimate service delivers a CAPTCHA from an npm CDN URL

Sources

• BleepingComputer — Hackers Abuse npm Mirrors to Host Phishing Redirect Pages

Related Reading

• Cline CLI Supply Chain Attack — OpenClaw
• AI-Assisted Fortigate Campaign Abuses Amazon Infrastructure