Threat actors are abusing the npm registry and its mirror services to host malicious HTML pages that impersonate Cloudflare CAPTCHA verification screens and redirect visitors to attacker-controlled websites.
Security researchers first identified this technique in July. Information 0 stash discovered a package named “china_airlines” that used a fake Cloudflare verification page to redirect users to malicious domains. The campaign was also reported by Intel Fusions.
In a subsequent investigation, OX Security identified 24 npm packages containing the same malicious HTML page. The pages were hosted on npm and distributed through several npm mirror services.
Unlike many npm supply-chain attacks, installing the packages does not appear to infect a developer’s computer with malware or steal information. Instead, the attackers are using npm as free storage for malicious HTML files.
Those files are then copied by mirroring platforms such as UNPKG and npmmirror. Because some of these services allow individual files within npm packages to be opened directly in a web browser, they can effectively provide free hosting for phishing pages.
“Although the malware is just a single HTML page in an npm package and is harmless to download, threat actors’ use of npm is not to infect developers who install it, but to use the registry and its mirrors as safe, verified storage for malware,” OX Security said.
BleepingComputer examined one package linked to the campaign and found that it contained only two files: an index.html page and a package.json file identifying the HTML document as the package’s main file.
Source: BleepingComputer
After UNPKG mirrors the package, the HTML file can be opened directly in a browser with a URL such as https://unpkg[.]com/[email protected]/index[.]html.
This causes the attacker’s HTML to load from the legitimate unpkg.com domain instead of attacker-controlled infrastructure. Hosting the page on a trusted npm mirror may help bypass security tools that would otherwise block a suspicious domain.
OX Security said the technique effectively turns npm mirrors into “free front-end hosts for malicious HTML pages and potentially other payloads.”
Malicious npm HTML pages act as redirectors
The malicious HTML page imitates a Cloudflare security verification screen and incorporates Cloudflare’s legitimate Turnstile CAPTCHA service.
Source: BleepingComputer
Whether or not the CAPTCHA validation succeeds, the page executes heavily obfuscated JavaScript that redirects the visitor to another website.
Moshe Siman Tov Bustan, head of the OX Security research team, told BleepingComputer that earlier versions redirected users to domains including microcloud[.]july and login[.]microsoft[.]live. Some of the initial redirects observed in July eventually led to legitimate Microsoft Outlook login pages.
BleepingComputer tested one of the malicious pages hosted on UNPKG and found that it was still redirecting visitors to one of the identified domains. Although that domain is currently offline, it could be used to host a fake Microsoft login page.
Other packages use a different redirect mechanism involving api.keyval.org, a legitimate service for storing key-value pairs. According to the researchers, the malicious JavaScript retrieves an encrypted value from the service, decrypts it in the browser, and redirects the visitor to the resulting URL.
This approach allows attackers to change the destination remotely without modifying or republishing the npm package. During OX Security’s investigation, the configured destinations redirected visitors to the legitimate ChatGPT website.
OX Security warned that the remote value could be changed at any time to point to ClickFix pages, phishing sites, or other malicious destinations. However, the npm-hosted HTML reviewed by BleepingComputer did not perform a ClickFix attack.
Depending on how the campaign is configured, these pages could redirect visitors to credential-harvesting sites, malware downloads, fake login portals, or other attacker-controlled content.
OX Security also warned that npm packages may remain available on mirror services even after they are removed from the official npm registry.
“Threat actors continue to discover and use new and novel techniques not only to distribute malware, but also to use legitimate infrastructure to store payloads and data,” OX Security concluded.
Researchers recommend treating direct HTML requests to npm mirror domains as potentially suspicious, particularly when the pages imitate Cloudflare verification screens or immediately redirect visitors to another website.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com