Attackers abuse npm mirrors to host phishing redirect pages
Attackers are hiding fake Cloudflare verification pages inside npm software packages. When mirror sites copy those packages, the fake page loads from a trusted developer domain and quietly redirects visitors to attacker-controlled sites.
- Report priority
- Medium
- Targets
- UNPKG+1 more
How it works
- An attacker publishes an npm package whose only real content is a single HTML page and a package.json file pointing to it as the main file.
- When mirrors like UNPKG serve that file directly from their own trusted domain, visitors see it as if it came from a legitimate developer site, and hidden obfuscated code on the page then redirects them elsewhere.
What to do
The risk comes from clicking a link, so treat any unpkg.com or npmmirror link that shows a Cloudflare verification page with suspicion, especially if it arrived in an email or message rather than from code you trust.
Run this in the application environment you want to check:
npm ls --all npmmirrorNpm, developers, and mirror operators need to detect and remove these fake packages, so if you land on one of these pages do not proceed past the verification prompt and close the tab instead of following any resulting redirect.
Technical details
Affected software: UNPKG, npmmirror
An attacker publishes a small npm package containing just an index.html file disguised as a Cloudflare security check. UNPKG mirrors the package, so the page can be opened straight from the trusted unpkg.com domain instead of the attacker's own site. A visitor who lands on that link sees what looks like a normal Cloudflare verification screen, but whether they pass it or not, hidden script on the page redirects them to another site the attacker controls, in earlier cases pages designed to look like a Microsoft login screen.
The campaign, tracked by OX Security and first flagged in July by researcher inf0stache and IntelFusion, involves npm packages whose only payload is an index.html file impersonating a Cloudflare Turnstile verification page. Because mirrors such as UNPKG and npmmirror serve individual package files directly in a browser, the phishing page renders from a trusted domain rather than attacker infrastructure, which can bypass security filters that block known-bad sites. Regardless of CAPTCHA outcome, obfuscated JavaScript on the page redirects visitors onward; OX Security identified 24 such packages, with redirect targets including microcloud.homes and, some ultimately leading toward a real Microsoft Outlook login page.