Hackers Exploit npm and Its Mirrors as Hosting for Phishing Pages

On August 25, 2026, a campaign emerged in which the npm registry and its mirrors are being used to host HTML pages that mimic Cloudflare security checks and redirect visitors to attacker-controlled sites. This is not a classic supply chain attack: installing the packages does not compromise the developer's computer. The attackers are exploiting npm infrastructure as free storage space for malicious content, which is then served from legitimate domains.

A Campaign of 24 npm Packages with Fake Cloudflare Pages

The technique had already been observed in July by researcher inf0stache, who identified the npm package china_airlines containing a fake Cloudflare verification page. The report was also picked up by IntelFusions. A subsequent report by OX Security uncovered 24 npm packages hosting the same malicious HTML page.

Unlike typical npm supply chain attacks, downloading and installing these packages does not infect the developer's computer with malware or infostealers. The goal is different: to use the npm registry as a free repository for HTML pages that will then be replicated by mirrors and served to end users.

How UNPKG and npmmirror Become Free Frontend Hosting

Platforms like UNPKG and npmmirror allow you to open individual files from an npm package directly in the browser. Examination of one of the campaign's packages showed that it contained only two files: an index.html and a package.json that declared the HTML as the package's main file.

When UNPKG mirrors the package, the HTML can be opened with a URL such as https://unpkg[.]com/[email protected]/index[.]html. The rendering therefore occurs from the legitimate domain unpkg.com, not from infrastructure controlled by the attackers. This makes it harder for security software to block the content because the domain has a good reputation. In practice, npm mirrors become free web hosting for phishing pages, without the attackers having to manage their own servers.

Obfuscated JavaScript That Always Redirects

The malicious HTML page impersonates a Cloudflare security verification page and incorporates Cloudflare's legitimate Turnstile CAPTCHA service. Regardless of the verification outcome, the page executes heavily obfuscated JavaScript that redirects the visitor. Even if the CAPTCHA is completed correctly, the user is still taken to the destination chosen by the attackers.

Moshe Siman Tov Bustan, head of the research team at OX Security, explained that earlier versions redirected to microcloud[.]homes in July and to login[.]microsofte[.]live in August. Some of the early July redirects ultimately led to the legitimate Microsoft Outlook sign-in page at outlook.office.com/mail.

A test conducted on one of the malicious pages served via UNPKG confirmed that it still redirects to login[.]microsofte[.]live. The domain is currently inactive, but it could be used in the future to host a fake Microsoft login page.

Abuse of Legitimate Services: Turnstile and keyval.org

In addition to Cloudflare Turnstile, the attackers are exploiting another legitimate service: api.keyval.org, a platform for storing key-value pairs. Some newer packages have abandoned direct redirects and use a more flexible method.

The JavaScript code retrieves an encrypted value from keyval.org, decrypts it in the browser, and redirects the visitor to the decrypted URL. This allows the attackers to change the destination remotely without modifying or republishing the npm package. At the time of OX Security's research, the remotely configured destination was the legitimate ChatGPT site.

OX Security warns that the value can be changed at any time to point to ClickFix pages or other phishing pages. The HTML page examined during the analysis does not perform a ClickFix attack, but pages in the campaign could redirect to phishing, malware downloads, or other attacker-controlled destinations.

Impact and Persistence on Mirrors

The severity of this campaign does not lie in direct compromise of developer systems, but in the abuse of trusted infrastructure. Loading pages from unpkg.com can evade reputation-based or blacklist-based controls, making it harder for security software to block malicious content.

End users can be redirected to fake Microsoft login pages, phishing pages, malware downloads, or ClickFix attacks. Additionally, npm packages can remain available on mirrors even after being removed from the official npm registry, prolonging the campaign's life and making removal more complex.

Mitigations and Indicators to Watch For

OX Security recommends treating direct HTML requests to npm mirror domains as potentially suspicious. No further technical mitigations have been provided at this time: there are no patches to apply because the issue is the abuse of legitimate infrastructure.

Known indicators include the malicious domains microcloud[.]homes and login[.]microsofte[.]live, the example URL https://unpkg[.]com/[email protected]/index[.]html, the legitimate service api.keyval.org exploited for remote redirection, and the npm packages china_airlines and ndmxchdjxn2, part of the 24 identified.

Monitoring logs for requests to unpkg.com or npmmirror.com that point to unusual HTML files can help identify exploitation attempts. Blocking known malicious domains and training users not to trust unexpected verification pages are immediate containment measures.