24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Cybersecurity researchers at OX Security have uncovered a campaign that abuses 24 npm packages as free phishing infrastructure. The packages host HTML files on npm mirrors like unpkg, which render as fake Cloudflare CAPTCHA pages on trusted domains. These pages redirect victims to ClickFix-style phishing infrastructure, potentially leading to malware deployment.

The attack leverages legitimate services, including unpkg and the KeyVal key-value store, to host and resolve malicious content. The threat actor initially used a typosquatted Microsoft login domain but switched to KeyVal after the domain was blocked by Google Chrome’s Safe Browsing. The remote logic currently redirects users to the legitimate ChatGPT website, but it could be weaponized to deliver ClickFix or other phishing domains.

This campaign follows a similar abuse in October 2025, when Socket reported 175 npm packages using unpkg to host redirect scripts in a campaign codenamed Beamglea. The researchers emphasize that threat actors are increasingly using legitimate infrastructure for storage and persistence, as npm packages can remain on mirrors even after removal from official stores.