Cybersecurity experts have uncovered a sophisticated phishing campaign involving 24 npm packages that exploit unpkg mirrors to host deceptive Cloudflare CAPTCHA pages. This innovative use of npm infrastructure poses a significant threat, redirecting unsuspecting users to malicious sites under the guise of legitimate services.
Npm Packages as Phishing Tools
The campaign leverages npm packages not to directly infect developers but to utilize npm’s registry and mirrors as a secure storage medium for phishing materials. As reported by OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko, the campaign manipulates npm to facilitate the storage of simple HTML pages that serve as phishing platforms.
The list of affected npm packages, some still available for download, includes names like bgzxcuite2, prezdentkxheiw, and egair0810. These packages target npm mirrors, particularly unpkg, to render fake Cloudflare CAPTCHA pages hosted on trusted domains, misleading users into engaging with phishing infrastructure.
The Mechanics of the Phishing Campaign
Once mirrored, the HTML file becomes a live fake CAPTCHA page, designed to redirect victims to external sites controlled by attackers. The HTML page contains embedded logic and JavaScript to execute the phishing operation, initially pointing to a domain impersonating Microsoft’s login page. However, after being blocked by Google Chrome’s Safe Browsing, the threat actors adapted by using KeyVal, a public key-value store, to redirect victims.
This approach effectively turns KeyVal into a dead drop resolver, enabling the attackers to extract and decode URLs for redirection. While the current setup redirects users to the legitimate ChatGPT site, the attackers have the capability to modify configurations, potentially leading users to harmful phishing domains.
Implications and Historical Context
This method of exploiting npm mirrors is not unprecedented. In October 2025, a similar tactic was documented involving 175 npm packages using unpkg.com’s CDN to facilitate credential harvesting. This historical precedent highlights the ongoing challenge cybersecurity experts face in combating infrastructure abuse.
OX Security emphasizes the persistent innovation of threat actors in utilizing legitimate platforms for malicious purposes. By exploiting npm as a persistent storage solution, attackers ensure their phishing tools remain accessible long after removal from official repositories.
This campaign underscores the need for vigilance and advanced threat detection to protect against such sophisticated phishing strategies. As threat landscapes evolve, so too must the security measures designed to counteract them.
