"While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor’s use of npm isn't to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware," OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko warned.
OX Security's disclosure and the tactic in plain terms
Researchers at OX Security described a campaign that places a single HTML file inside npm packages and relies on public mirrors to make that file live on trusted domains. Once mirrored, the page renders as a ClickFix-style fake Cloudflare CAPTCHA prompt and then redirects victims to external infrastructure controlled by the attacker. The HTML page contains both the visual prompt and JavaScript that sends a request to a remote server; the observable outcome is that anyone who opens a mirrored link can be tricked into actions that "can lead to the deployment of malware," the researchers said.
The 24 npm packages observed in the campaign
- bgzxcuite2
- prezdentkxheiw
- egair0810
- mnteckets
- airdzticket
- egypt0811
- passport811
- vxhjkseuiaqkb
- ndmushdkeqe
- ndmxchdjxn2
- ndmfguyhoxc3
- mjsdqwocvn
- m2fcsfyjkuxb
- m3fdfocdoewn
- @worrisome/reutil
- testdgdbcsd
- tesgfvbncsdbcv
- mndsxcusiwlk1
- mn2adskhweox
- mn3sadkoiewu
- mn4xcouzvhus
- mbxcnsuwgs1
- skxcmwuncbg2
- mobiwaefhxc3
OX Security said some of these packages are still available for download from the registry. The key operational detail is that mirrors such as unpkg convert the package contents into live web pages — for example, an index file becomes accessible at a path like unpkg[.]com/ndmxchdjxn2@1.0.0/index.html — and that trusted hosting masks the malicious intent.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageUnpkg mirrors, typosquat domains, and the move to KeyVal
Initial iterations of the campaign were observed sending requests to a typosquat impersonating the Microsoft login page, cited as "login[.]microsofte[.]live" in OX Security's write-up. After that domain was added to Google Chrome's Safe Browsing blocklist, the actor changed approach: the campaign began using KeyVal (identified as "api.keyval[.]org"), a free public key-value store, as a dead drop resolver (DDR). In this configuration the HTML's remote logic retrieves and decodes a URL from KeyVal and then redirects the user.
OX Security noted that "currently the remote logic transfers the user to the legitimate ChatGPT website, but it could be weaponized to deliver ClickFix or any other phishing domains when configured to by the attacker," illustrating that the current benign destination can be altered without changing the mirror-hosted HTML.
Earlier precedent: the Beamglea campaign tracked by Socket
This is not novel in principle. OX Security pointed to October 2025 reporting by Socket that documented 175 npm packages using unpkg.com's CDN to host redirect scripts that routed victims to credential-harvesting pages in a campaign named Beamglea. The recurrence reinforces the pattern: threat actors leverage open registries and their public mirrors as persistent, validated storage for phishing and redirect logic.
What this means for technologists, npm maintainers, and end users
- Technologists and security teams — Be aware that npm registries and public mirrors can serve one-file HTML payloads as live sites on trusted domains. OX Security's findings show attackers can pivot quickly (for example, switching from a typosquat to a KeyVal-based DDR) in response to blocklisting.
- Open-source maintainers and registry operators — The researchers emphasize that packages "can live forever in mirrors even after they are removed from the official stores," turning mirrors into a persistence mechanism. That persistence complicates takedown strategies and shifts the problem from package removal to mirror remediation.
- End users and general audiences — Links hosted on npm mirrors can look legitimate because they resolve on trusted domains. Opening such links can surface fake verification prompts that then redirect to attacker-controlled sites, potentially leading to credential theft or malware delivery.
OX Security's central warning is twofold: the malware component in these packages is minimal in size and scope — a single HTML file — yet the abuse is systemic, turning legitimate infrastructure into covert hosting and persistence. As the researchers put it, "When we think of malware as families of code that steal data directly from the machine they are running on, we can miss other ideas such as infrastructure abuse, using npm and its mirrors as free storage, and persistence." Given the actor's switch from a typosquat domain to KeyVal, the campaign also illustrates how fast operators can adapt when straightforward defenses (for example, Safe Browsing blocklists) are applied.
Read the original report: https://thehackernews.com/2026/08/24-npm-packages-abuse-unpkg-mirrors-to.html
