Hackers Abuse unpkg Mirrors via 24 npm Packages to Host Fake Cloudflare CAPTCHAs

Cybersecurity researchers at OX Security have uncovered a phishing campaign leveraging 24 malicious npm packages as free infrastructure to host fake Cloudflare CAPTCHA verification pages. The packages—namespaced under handles including bgzxcuite2, prezdentkxheiw, and @worrisome/reutil—are still partially available on the npm registry. According to researchers Moshe Siman Tov Bustan and Vitalii Chepurko, the threat actor is not targeting developers who install the packages; instead, the npm registry and its CDN mirrors are being used as "safe, validated storage" for a single HTML payload that serves as the phishing lure. Anyone landing on a mirror link such as unpkg[.]com/ndmxchdjxn2@1.0.0/index.html is presented with a fully-rendered Cloudflare-branded CAPTCHA page hosted on a trusted domain, then redirected to attacker-controlled infrastructure capable of launching ClickFix-style attacks or harvesting credentials.

The HTML payload embeds both the fake verification prompt and JavaScript that beacons out to a remote server to fetch the next-stage destination. Early versions of the malware communicated with a typosquat domain impersonating the Microsoft login page, login[.]microsofte[.]live. Once that domain was added to Google Chrome's Safe Browsing blocklist, the operator pivoted to KeyVal (api.keyval[.]org), a free public key-value store with a REST API, repurposing the legitimate service as a dead drop resolver (DDR) to dynamically retrieve and decode redirect URLs. Investigators and defenders can validate the infrastructure behind these lures using a WHOIS lookup to confirm domain age and registrant details, or run the hostnames through an SSL/TLS checker to expose mismatched or self-signed certificates on phishing infrastructure. "Currently the remote logic transfers the user to the legitimate ChatGPT website, but it could be weaponized to deliver ClickFix or any other phishing domains when configured to by the attacker," the OX Security team noted.

This technique echoes a broader pattern of abusing trusted CDNs as malware staging grounds. In October 2025, Socket researchers documented a separate operation codenamed Beamglea involving 175 npm packages that used unpkg.com's CDN to serve redirect scripts leading to credential harvesting pages. The recurring abuse of package registries and their mirrors underscores how attackers increasingly rely on the reputation of legitimate platforms to bypass secure web gateways and user suspicion—reputational laundering through infrastructure that defenders have traditionally whitelisted. Users who suspect exposure to this kind of lure should run an privacy checkup on their browsing session and rotate any credentials that may have been entered after a suspicious redirect, particularly Microsoft or SSO logins served from unexpected subpaths.