Security researchers at OX Security have identified 24 malicious npm packages being used as infrastructure to serve fake Cloudflare CAPTCHA pages that redirect victims to ClickFix phishing sites — abusing npm's trusted ecosystem and the unpkg content delivery network as free, credible-looking malware hosting.
How the Attack Works
The attack chain is deceptively clever in how it exploits legitimate infrastructure:
- Attackers publish packages to npm — packages with innocuous or randomized names (including
bgzxcuite2,prezdentkxheiw,egair0810,mnteckets,airdzticket,egypt0811,passport811, and ~16 others) - The unpkg CDN serves the payload — unpkg automatically mirrors npm packages, meaning any file in a published package is instantly accessible at
unpkg.com/<package>@1.0.0/index.html - Victims are served a fake Cloudflare CAPTCHA page — rendered convincingly via the legitimate unpkg domain
- A dead drop resolver updates the final destination — the campaign uses KeyVal (
api.keyval.org), a free key-value store, to dynamically update redirect destinations without modifying the npm packages themselves
This dead drop resolver pattern means attackers can pivot the phishing target — from typosquatted Microsoft login pages to ChatGPT credential harvesting — without republishing any packages.
Targets: End Users, Not Developers
Critically, these packages are not supply chain attacks against developers. The npm packages are not designed to be installed and executed in a developer's build pipeline. Instead, they serve purely as hosting vehicles for phishing infrastructure — leveraging npm's trusted domain and CDN to make malicious HTML appear to originate from a reputable source.
The end victims are regular users who encounter the phishing URLs through other delivery mechanisms (social engineering, malicious ads, redirects), not developers installing dependencies.
The ClickFix Connection
The phishing pages mimic the ClickFix social engineering technique — a pattern where users are prompted to complete a fake CAPTCHA or "fix" step that actually copies and executes malicious clipboard content or redirects to a credential harvesting page.
Initial versions of the campaign redirected to typosquatted Microsoft login pages. Current iterations redirect to ChatGPT, demonstrating how quickly the infrastructure can pivot targets using the KeyVal dead drop.
Historical Parallel: Beamglea Campaign
OX Security researchers note that this campaign mirrors the Beamglea campaign from October 2025, in which 175 malicious npm packages were similarly weaponized via the unpkg CDN for phishing infrastructure. The current campaign represents either a continuation, an evolution, or a copycat of that earlier operation.
The reuse of the same technique across campaigns indicates that this vector is both low-cost and effective enough to warrant repeat exploitation.
Why This Matters for Security Teams
The unpkg abuse pattern is notable because it exploits trust in legitimate infrastructure:
unpkg.comis widely allowlisted — organizations that filter traffic by domain reputation will not block it- npm publishing is open — there are no significant barriers to creating throwaway packages
- KeyVal as a dead drop — legitimate key-value services are not commonly blocked and provide operational flexibility
This combination of legitimate infrastructure abuse makes traditional URL/domain-based filtering insufficient to detect or block the phishing delivery.
Detection and Mitigation
- Monitor for unpkg.com traffic to unfamiliar package paths — especially paths that serve HTML content rather than JavaScript
- Implement content inspection at the proxy level for pages mimicking CAPTCHA or login flows served from CDN domains
- Educate users about ClickFix patterns — the request to complete a CAPTCHA or interact with an unusual browser prompt is a key social engineering signal
- Report suspicious npm packages: Use
npm reportor contact security@npmjs.com for packages with no legitimate developer use case
For defenders protecting enterprise environments, these campaigns underscore that supply chain monitoring must extend beyond dependency analysis to include how open registries can be weaponized as hosting infrastructure.
Discovered by: Moshe Siman Tov Bustan and Vitalii Chepurko at OX Security
Source: The Hacker News — 24 npm Packages Abuse unpkg Mirrors