Researchers have uncovered a coordinated phishing campaign leveraging 24 npm packages to redirect users to counterfeit Cloudflare CAPTCHA pages, exploiting npm's unpkg mirror service as free hosting for fake credential-harvesting sites.
The attack operates through a novel abuse vector. Threat actors packaged single HTML files within legitimate-looking npm modules, then exploited unpkg, a content delivery network that mirrors npm package contents. When users access these packages through unpkg URLs, they receive redirect instructions pointing to fake Cloudflare CAPTCHA pages styled to steal login credentials. The malware itself poses no direct risk to developers who install the packages. The actual target differs from traditional npm supply chain attacks: rather than compromising developer machines, attackers use npm's infrastructure as free phishing hosting to deceive end users visiting the unpkg URLs.
This ClickFix-style attack pattern mirrors recent campaigns where threat actors create convincing fake security warnings to manipulate users into providing credentials or sensitive information. By disguising phishing pages as Cloudflare CAPTCHAs, attackers exploit the ubiquity of this authentication method and user familiarity with Cloudflare's branding.
The campaign reveals how attackers repurpose open source package repositories beyond their intended function. npm's unpkg service, designed to enable developers to reference package contents via CDN, becomes an unintended vector for phishing infrastructure. The distributed nature of the 24 packages suggests either multiple threat actors or a single group testing different package names to maximize reach before detection.
The discovery highlights a blind spot in npm security models. Package repositories typically focus on detecting malware in installed code rather than monitoring how packages are accessed or referenced externally. Attackers can abuse this assumption by creating packages with no malicious payload, relying instead on the unpkg redirect mechanism to deliver phishing content.
This approach offers distinct advantages for attackers. They avoid the computational overhead of maintaining dedicated phishing servers, reduce infrastructure costs, and gain legitimacy through association with npm and unpkg's trusted domains. Users visiting unpkg URLs encounter legitimate npm infrastructure, lowering suspicion before the redirect fires. Law enforcement action against individual phishing pages becomes harder when the delivery mechanism is distributed across dozens of npm packages.
Organizations and developers face multiple risks. Users who interact with these packages through unpkg links face credential theft. Organizations using unpkg to reference npm packages should audit access logs for suspicious package names. Developers should understand that creating an npm package doesn't guarantee it won't be misused outside typical installation workflows.
npm and unpkg maintainers will likely implement additional controls. These could include rate limiting redirects from specific packages, monitoring for redirect patterns consistent with phishing, or requiring package authors to declare intended use cases. The incident also underscores why developers should prefer pinned package versions and authenticated registries over open CDN access when possible.
This campaign demonstrates how attackers continuously adapt to exploit legitimate services. The barrier to entry remains low, making this vector attractive for threat actors seeking scalable phishing infrastructure without traditional hosting costs.