Attackers are exploiting the npm registry and its mirrors to host malicious HTML pages disguised as a Cloudflare security verification page, then redirect visitors to a domain they control or to a destination that can be changed remotely. This campaign differs from typical npm supply-chain attacks: the packages examined by researchers do not infect a developer’s device with malware when installed, but are instead used as free hosting for phishing pages.
Security researcher inf0stache observed this technique in July after finding a package named china_airlines that included a fake Cloudflare verification page. IntelFusions reported the same technique before OX Security later uncovered 24 npm packages containing the same malicious page, distributed across npm and several mirrors.
How Does a Mirror Become a Phishing Platform?
BleepingComputer found that one of the examined packages contained only two files, index.html and package.json, with the HTML file defined as the main file. When the UNPKG service copies the package, the file can be opened directly in a browser through the unpkg.com domain instead of a domain operated by the attackers.
This use gives the malicious page a more trustworthy appearance and may help it bypass security tools that block known attacker domains. OX Security also warned that packages may remain available on mirrors even after being deleted from the official npm registry.
Fake Verification and a Changeable Redirect
The malicious page imitates Cloudflare’s security interface and includes the legitimate Turnstile service, but whether the verification succeeds or fails does not stop obfuscated JavaScript from executing the redirect. According to the researchers, earlier versions in July led to microcloud[.]homes, while referrals to login[.]microsofte[.]live appeared in August. Reports indicated that some early referrals ended at the legitimate Microsoft Outlook sign-in page, while the same destinations could later be used to host fake login pages.
Other packages used a different technique based on api.keyval.org, a legitimate platform for storing key-value pairs. The code retrieves an encrypted value from the service, decrypts it in the browser, and then redirects the visitor to the resulting URL. This allows the attacker to change the destination without modifying or republishing the npm package. OX said that the destination it observed during its research was the legitimate ChatGPT website, with the possibility of later changing it to a phishing page or a malware download; however, the page reviewed by BleepingComputer did not execute a ClickFix attack.
Why Does This Matter?
The actual change here is not infecting a developer simply by installing the package, but abusing trust in a common development infrastructure to load content displayed directly in a browser. This expands the scope of the risks to include users of direct links to files on npm and its mirrors, not just development teams. OX Security therefore recommends treating direct HTML requests from npm mirror domains as suspicious activity, while bearing in mind that the final destination may change without updating the hosted file.