Dateline: August 26, 2026
24 npm Packages Turn Trusted Developer Domains Into Phishing Bait
Package registries were built to share code. Now attackers are using them to share phishing pages.
Researchers uncovered a campaign that plants 24 npm packages carrying a single trick. Each one holds one HTML file. That file loads a fake Cloudflare CAPTCHA screen. When a mirror site copies the package, the fake page goes live on a domain that looks completely legitimate. The finding was covered by The Hacker News, BleepingComputer, and Cybernews this week.
What Happened?
The packages do nothing when installed. That is the part that makes this campaign different. There is no infostealer, no wallet drainer, no code that runs on your machine.
The attackers are not after developers who install the package. They want the free storage. Every time someone uploads a package to npm, mirror services like unpkg and npmmirror copy it automatically. Many of these mirrors serve the individual files directly on the open web. So an attacker uploads a junk package with one HTML file, waits for the mirror to copy it, then shares the mirror link.
Anyone who opens that link sees a fake verification prompt on a trusted domain. Behind the page sits JavaScript that calls out to a remote server for a redirect address. Early samples pointed to a typosquat of the Microsoft login page. After Google Chrome Safe Browsing blocked that domain, the attacker switched to a free public key value store and used it as a hidden lookup for the next destination. That lets them change where victims land without touching the package at all.
At the time of the research, the redirect sent people to the real ChatGPT site. The researchers warned it could be flipped to a ClickFix lure or a credential harvesting page at any moment. Each package pulled roughly 50 to 300 weekly downloads before removal.
What’s the Impact?
The reach here is not about downloads. It is about trust.
A phishing link on a random domain gets flagged fast. A phishing link on a domain developers already trust slips past filters and past people. That is the whole point of the abuse.
There is a persistence problem too. Packages pulled from the official npm registry can stay alive on mirrors long after removal. So a takedown does not always mean the page is gone. The redirect address can also be swapped remotely, which means one package can serve many different scams over its life.
This follows a similar 2025 campaign that used the same CDN trick to route victims to credential pages. The method is spreading because uploading to npm is free and open.
npm Mirror ClickFix Phishing Campaign
Fake Cloudflare CAPTCHA pages hosted via npm mirrors. Sourced from OX Security and The Hacker News, August 2026.
Network Indicators
Malicious npm Packages (24)
Behavioral Detection Guidance
Sources: OX Security research, The Hacker News, BleepingComputer, Cybernews (Aug 2026). Verify current status before actioning. Redirect targets can change remotely.
How to Avoid This
- Treat direct HTML requests to npm mirror domains as suspicious, which is the researchers’ own advice.
- Watch for these patterns. Block or flag them where you can.
- Direct hits to raw HTML files on mirror domains like unpkg.com and npmmirror.com deserve a second look, especially index.html served straight from a package path.
- Any CAPTCHA or verification page that asks you to copy, paste, or run a command is a red flag. Real Cloudflare checks never do that.
- Web filters should not auto trust a domain just because developers use it. Reputation is not the same as safety here.
- Security teams can monitor new package uploads that carry only an HTML file and no real code, since that shape fits this campaign.
