npm Mirror Networks Exploited as Free Hosting for Cloudflare CAPTCHA Phishing
npm mirrors exist to speed up downloads. But somebody turned them into free frontend hosts for malicious HTML. Threat actors are abusing UNPKG, npmmirror, Yarn and Tencent mirrors to serve phishing pages that impersonate Cloudflare Turnstile CAPTCHAs. The npm registry becomes trusted storage, and mirror domains let anyone open those HTML pages directly in a browser from a legitimate-looking URL. That bypasses security software that might otherwise block a known criminal domain.
How the Abuse Works
Attackers upload npm packages containing only an index.html and a package.json file. The HTML page mimics a Cloudflare security verification screen complete with a legitimate Turnstile CAPTCHA. Regardless of whether the verification succeeds, the page executes heavily obfuscated JavaScript that redirects the visitor to another site. Earlier versions redirected to microcloud.homes in July and login.microsofte.live in August; some of those earliest July redirects ultimately resolved to the legitimate Microsoft Outlook mail login site. Newer code retrieves an encrypted value from api.keyval.org, decrypts it in the browser, then redirects to the decrypted URL. This lets attackers change the redirect destination remotely without modifying or republishing the npm package. At the time of OX Security research, the remotely configured destination redirected visitors to the legitimate ChatGPT website. The value could be changed at any time to point to ClickFix or other phishing pages.
The trick mirrors depend on: mirroring platforms expose individual package files directly rather than only the compressed archive. A link to an HTML file can render a complete page in a browser, effectively giving attackers a front end on a recognized domain. Visitors who receive a direct link see the phishing page hosted under a domain associated with package delivery, not an obvious criminal site. This highlights how trusted web infrastructure can be repurposed for social engineering.
Mirror persistence after take‑down: One concern researchers flag is that npm packages may remain on mirrors after being removed from the official npm registry. Even after a package is taken down from the primary registry, mirror services may continue serving the HTML file. That means a removed package may remain available through mirrors, extending the life of the phishing campaign well beyond the initial discovery window.
Indicators of Compromise
The campaigns produce a distinct set of IoCs. Package names often follow typosquatting patterns—bgzxcuite2, prezdentkxheiw, egair0810 and others mimicking Microsoft family names. Newer families use the keyval logic: ndmushdkeqe, ndmxchdjxn2, ndmfguyhoxc3 and packages tagged keyval new-logic family. Domains implicated include the typosquatted Microsoft domain login.microsofte.live and the legitimate key-value service api.keyval.org. Direct mirror-hosted URLs such as https://unpkg.com/[email protected]/index.html are also flagged. Researchers at OX Security and BleepingComputer documented these indicators, and they are intentionally defanged in public reports to prevent accidental resolution.
The CybersecurityNews source confirmed that 24 malicious npm packages abuse trusted mirrors to host ClickFix phishing pages. Package names include both Microsoft typosquat family packages (bgzxcuite2, prezdentkxheiw, egair0810, mntsckets, airdzticket, egypt0811, passport811) and keyval new-logic family packages (ndmushdkeqe, ndmxchdjxn2, ndmfguyhoxc3, mjsdqwocvn, m2fcsfyjkuxb, m3fdfocdoewn, @worrisome/reutil, testdgdbcsd, tesgfvbncsdbcv, mndsxcusiwlk1, mn2adskhweox, mn3sadkoiewu, mn4xcouzvhus, mbxcnsuwgs1, skxcmwuncbg2, mobiwaefhxc3). An encoded value PpihAtpV1i29jeS3Skk7XU74X2Zkd5wyzF2DOzY77k1Fz7GNvGafkxVGs+z6VOGy6E43n+JQgKSUsn+S5NjXlBmcq4= is retrieved through the remote logic. Direct mirror-hosted URLs like https://unpkg.com/[email protected]/index.html are flagged as IoCs.
Domains: login.microsofte.live (typosquatted Microsoft domain used by the earlier campaign version) and api.keyval.org (legitimate key-value service abused to retrieve encrypted redirect data). Earlier versions redirected to microcloud.homes in July and login.microsofte.live in August. Some of the earliest July redirects ultimately resolved to the legitimate Microsoft Outlook mail login site. Newer code retrieves an encrypted value from api.keyval.org, decrypts it in the browser, then redirects to the decrypted URL. At the time of OX's research, the remotely configured destination redirected visitors to the legitimate ChatGPT website. While OX says the value could be changed at any time to point to ClickFix or other phishing pages, the npm-hosted HTML reviewed by BleepingComputer does not perform a ClickFix attack.
Defense Recommendations
Security teams should not automatically block every package mirror since these services support normal development work. However, mirror domains should be treated as possible phishing hosts when users are not downloading packages. Adding mirror URLs to phishing and URL-reputation checks can help identify abuse that conventional filters might overlook. Defenders should also review proxy and DNS records for direct requests to .html files within mirrored packages. Such activity is more suspicious than a routine dependency download, particularly when it comes from employee endpoints without a development role. Teams can reduce exposure by validating package names and publishers, limiting access to unneeded public mirrors, and teaching staff never to paste verification commands into a terminal or Run dialog under the guise of completing a CAPTCHA check.
The core problem is flexibility. Remote logic directed users to the real ChatGPT site; researchers warned the destination could change to a ClickFix page or another phishing lure without changing the mirrored package file. That flexibility is what makes the campaign difficult to defend against using static blocklists alone. npm mirrors are free, trusted, and—and increasingly—abused.
This article draws on reporting from BleepingComputer and Cyber Security News, which confirmed that 24 malicious npm packages abuse trusted mirrors to host ClickFix phishing pages and that threat actors use npm and its mirrors to host malicious HTML pages impersonating Cloudflare CAPTCHAs to redirect visitors to attacker‑controlled websites.