Cybersecurity researchers at OX Security have uncovered a campaign that abuses 24 npm packages as phishing infrastructure by leveraging unpkg mirrors to host fake Cloudflare CAPTCHA pages. According to the researchers, the campaign is not designed to compromise developers who install the packages. Instead, the threat actor uses the npm registry and its mirrors as trusted storage locations for malicious HTML content that can later be accessed through legitimate domains. When mirrored by services such as unpkg, the HTML files become publicly accessible fake verification pages capable of redirecting visitors to external phishing infrastructure. OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko said the approach demonstrates how trusted software repositories can be misused to support phishing campaigns without distributing traditional malware through package installation.
The campaign involves 24 npm packages, some of which remain available for download, containing a single HTML page rather than malicious software. Once the packages are mirrored by unpkg, users visiting links hosted on the service are presented with a fake Cloudflare verification page that imitates a legitimate CAPTCHA challenge. After interacting with the page, victims are redirected to attacker controlled infrastructure where additional phishing or malware related activity can take place. Researchers found that the HTML includes JavaScript capable of communicating with remote servers to determine where users should be redirected. Earlier versions of the campaign relied on a typosquatted Microsoft login domain, but after that domain was added to Google Chrome Safe Browsing protections, the attackers changed their approach by using KeyVal, a legitimate public key value service, as a dead drop resolver to retrieve encoded redirect destinations dynamically.
Researchers noted that the current version of the campaign ultimately redirects users to the official ChatGPT website, but emphasized that this behavior can be changed at any time by the attackers to point victims toward ClickFix infrastructure or other phishing websites. By relying on trusted platforms such as npm, unpkg and KeyVal, the campaign attempts to reduce suspicion while making malicious infrastructure more difficult to detect and disrupt. OX Security explained that this technique highlights a growing trend in which threat actors abuse legitimate online services rather than relying solely on dedicated malicious infrastructure. The researchers also noted that using mirrored repositories allows malicious content to remain available even after packages are removed from the official npm registry, increasing the persistence of the campaign.
The findings follow earlier research published by Socket in October 2025, which identified 175 malicious npm packages that abused unpkg’s content delivery network to redirect users to credential harvesting pages in a campaign known as Beamglea. OX Security said threat actors continue to develop new techniques that focus not only on malware delivery but also on abusing legitimate infrastructure for storage, persistence and phishing operations. The researchers warned that security teams should pay closer attention to infrastructure abuse within software supply chains, as trusted repositories and development services can become part of phishing campaigns even when the hosted packages themselves contain only minimal code.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
