"While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor's use of npm isn't to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware," explains OX Security.
How npm and mirrors are being repurposed as free web hosts
Threat actors have been uploading HTML files to the npm registry and letting public mirrors copy those files so the pages can be opened directly in a browser. Security researcher inf0stache first spotted the technique in July with a package named "china_airlines," a finding later reported by IntelFusions. In a follow-up analysis, OX Security discovered 24 npm packages containing the same malicious HTML page hosted on npm and various mirrors.
Unlike the supply-chain attacks that inject malware into developer environments, these packages do not install malware or infostealers on a developer's computer. Instead, attackers treat npm as free, validated storage; mirroring platforms such as UNPKG and npmmirror make individual files accessible via URLs that serve content from the mirror's legitimate domain, effectively converting developer package mirrors into frontend hosts for phishing pages.
The Cloudflare Turnstile impersonation and redirect mechanics
The malicious HTML impersonates a Cloudflare verification page and embeds Cloudflare's legitimate Turnstile CAPTCHA service. Regardless of whether a visitor passes the CAPTCHA, heavily obfuscated JavaScript on the page executes and redirects the browser to an attacker-controlled destination.
OX Security research team lead Moshe Siman Tov Bustan told BleepingComputer that earlier versions redirected visitors to microcloud[.]homes in July and to login[.]microsofte[.]live in August. The researchers said some of the earliest July redirects ultimately resolved to the legitimate Microsoft Outlook mail login site at https://outlook.office.com/mail. BleepingComputer tested one of the malicious pages hosted through UNPKG and confirmed it still redirected visitors to that domain; the domain was not currently live at the time of testing but may be used to host a fake Microsoft login page.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageRemote-configurable redirects via api.keyval.org and live examples
Some packages changed tactics, using api.keyval.org — a legitimate key-value storage platform — as a remote control for the redirect target. The malicious HTML retrieves an encrypted value from api.keyval.org, decrypts it in the browser, and then redirects the visitor to the decrypted URL. That design lets attackers alter the redirect destination without republishing the npm package.
At the time of OX's research the remotely configured destination redirected visitors to the legitimate ChatGPT website, but the researchers noted the stored value could be changed to point to phishing pages or other malicious hosts. The packages reviewed by BleepingComputer did not perform a ClickFix attack, though OX warned the technique could be repurposed for other payloads.
Concrete examples and why mirrors can bypass protections
BleepingComputer examined one flagged package and found only two files: an index.html and a package.json that declared index.html as the package's main file. When UNPKG mirrors that package, the HTML can be opened directly in a browser using a URL such as https://unpkg[.]com/ndmxchdjxn2@1.0.0/index[.]html. Because the malicious page is served from the legitimate unpkg.com domain rather than infrastructure owned by the threat actor, it can bypass security software that blocks suspicious domains.
OX summarized the practical consequence plainly: npm mirrors become "free frontend hosts for malicious HTML pages and potentially other payloads as well." The company also warned that npm packages may remain available on mirrors after removal from the official npm registry, prolonging exposure even after takedown.
What this means for technologists, registry operators, and end users
- Technologists and security teams: Treat direct HTML requests to npm mirror domains as potentially suspicious, monitor unusual unpkg or npmmirror URLs, and consider blocking or inspecting content served from mirrors if detection is based on domain reputation.
- Registry operators and mirror platforms: Coordinate takedowns and consider mechanisms to prevent public hosting of arbitrary HTML files that can be served directly, recognizing that removal from the registry may not purge mirror caches.
- End users and general public: Be cautious of unexpected Cloudflare-style verification pages and redirects to login pages; a CAPTCHA-looking page served from a known CDN or mirror domain can still be a redirector to phishing sites.
OX Security concluded with a sober reminder: "Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data." The observation fits a broader defensive challenge: overall prevention scores can hide what happens after initial access — and, as one report summarized, once attackers are using valid credentials prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Link to original reporting: https://www.bleepingcomputer.com/news/security/hackers-abuse-npm-mirrors-to-host-phishing-redirect-pages/
