Threat actors have found an unusual way to host phishing pages without paying for a server or a domain: they upload a single malicious HTML file inside an otherwise empty npm package. When npm’s mirroring services — such as UNPKG and npmmirror — copy the package, they also make that HTML file accessible directly from a browser via a URL that looks like a developer tool. Visitors who land on the page see a convincing Cloudflare CAPTCHA prompt; clicking “verify” silently redirects them to an attacker-controlled site.
Security researcher inf0stache first spotted the technique in July when a package called china_airlines appeared in the npm registry. OX Security later found 24 packages using the same approach. Unlike the supply chain attacks that typically alarm developers — where installing a package infects the developer’s machine — this technique doesn’t harm anyone who installs the package. The npm registry is simply being used as free, credible-looking file storage. The risk lands on users who encounter links to these mirrored pages in phishing emails, SMS messages, or through malvertising, and who trust the unpkg.com or npmmirror.com domain names because they recognize them as legitimate developer infrastructure.
Sources
- BleepingComputer — Hackers abuse npm mirrors to host phishing redirect pages
- OX Security (original 24-package research, cited in BleepingComputer)