In a recent cybersecurity breakthrough, 24 npm packages have been identified as exploiting trusted package mirrors to stage phishing attacks. These packages, rather than directly infecting developers, leverage the trust in established hosting domains to make phishing pages appear legitimate.
Phishing via Trusted Domains
The malicious packages contain a single HTML file mimicking a Cloudflare verification page. When accessed through a mirror URL, the page connects to attacker-controlled infrastructure, redirecting the visitor to malicious sites. This method utilizes the registry ecosystem as a delivery channel, rather than a direct malware execution point.
Researchers from OX Security detected these 24 malicious packages, which were removed after amassing 50 to 300 weekly downloads. Despite their removal, the packages may still be accessible through mirrors, posing an ongoing threat.
Exploiting Web Infrastructure
npm packages are automatically mirrored by services like unpkg, Yarn, and others, which expose package files directly. This allows attackers to render a full page in browsers using a mirrored HTML file, effectively repurposing trusted domains for phishing.
The malicious HTML file presents a fake CAPTCHA and uses obfuscated JavaScript to interact with remote services, determining the visitor’s redirection path. This approach is similar to previous campaigns where npm packages hosted phishing redirects, proving attractive for credential-focused attacks.
Preventive Measures and Recommendations
Security teams are advised against indiscriminately blocking package mirrors, as they support legitimate development activities. Instead, mirrors should be monitored as potential phishing hosts. This includes adding mirror URLs to phishing and URL-reputation checks to identify misuse overlooked by conventional filters.
Developers should exercise caution with direct mirror links received via messages or search results. It’s crucial to validate package names and publishers and limit access to unnecessary public mirrors. Educating staff to avoid executing verification commands in terminals is also recommended.
Conclusion
This incident challenges the assumption that non-infectious installations equate to harmless packages. The malicious npm packages serve as storage for phishing components, which may persist even after their removal from registries. Vigilant assessment of package behavior and delivery routes is vital to mitigating such threats.
