24 npm Packages Turned unpkg Into a Phishing Host

A malicious npm package usually earns its headline in the postinstall script. These have no script. Each of the 24 packages OX Security found holds two files, and the interesting one is called index.html. The developer ecosystem is not the target. The hosting is.

Key Takeaways

• OX Security identified 24 npm packages carrying the same malicious HTML page, which mirrors including UNPKG and npmmirror republish as browsable web pages. Installing them infects nothing.
• BleepingComputer examined one package and found only two files: an index.html page and a package.json declaring it as the package main file.
• The page impersonates a Cloudflare security check while embedding Cloudflare's real Turnstile widget, then runs obfuscated JavaScript that redirects the visitor whether or not the check passes.
• Redirect destinations moved from microcloud[.]homes in July 2026 to login[.]microsofte[.]live in August 2026, a typosquat of Microsoft's login hostname that was not live when researchers checked it.

What Did Researchers Actually Find?

They found 24 npm packages that exist only to hold a phishing page. Security researcher inf0stache spotted the technique in July 2026 in a package named china_airlines, which used a fake Cloudflare verification page to bounce visitors to a malicious domain; IntelFusions reported it separately. OX Security then found the same HTML across 24 packages, as BleepingComputer reported on 25 August 2026.

OX put it plainly: "the threat actor's use of npm isn't to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware." The Miasma worm that hit 32 Red Hat npm packages and the North Korean poisoning of 141 packages through Mastra AI both ran code on developer machines. This one runs nothing, which is why it is harder to see.

How Does a Package Become a Phishing Page?

Because npm mirrors serve any file in a package, not just the JavaScript. UNPKG describes itself on its own homepage as "a fast, global content delivery network for everything on npm" that lets you "load any file on npm using a URL" shaped unpkg.com/:package@:version/:file. That sentence is the whole vulnerability. It is not a bug, it is the product.

Four steps, no exploit anywhere in the chain:

• Publish. Push index.html plus a package.json naming it as main. npm accepts it, because a package of static assets is ordinary.
• Mirror. UNPKG and npmmirror copy the tarball automatically. No approval, no review, no relationship with the publisher.
• Render. The mirror serves it over HTTPS with a content type the browser paints rather than downloads, at a URL like https://unpkg[.]com/ndmxchdjxn2@1.0.0/index[.]html.
• Bypass. The page now originates from unpkg.com, which reputation engines rate clean and most corporate proxies allow outright, because blocking it breaks front end builds. It renders, in BleepingComputer's words, "rather than from infrastructure controlled by the threat actor, potentially bypassing security software."

Step four is the payoff: an attacker who registers a domain starts at zero reputation, while one who publishes to npm inherits somebody else's.

Why Does a Fake Cloudflare Check Work?

Because the Cloudflare part is genuine. The page embeds the real Turnstile widget, and Cloudflare's Turnstile documentation confirms the design choice that allows it: "Turnstile is designed to be an independent service. You can use Turnstile on any website, regardless of whether it is proxied through Cloudflare network." Anyone with a sitekey renders it anywhere, and the visitor sees a widget they have cleared a hundred times behaving exactly as it should.

The verification result is decoration. Pass or fail, obfuscated JavaScript fires the redirect. Some packages hardcode the destination; others fetch an encrypted value from api.keyval.org, a legitimate service for storing "key-value pairs", decrypt it in the browser and go wherever it decodes to. That turns a developer utility into a dead drop resolver and lets one operator repoint all 24 packages without republishing a version. At research time the destination was the real ChatGPT site, which reads as a test rather than a payload.

Same visual con as ClickFix, which we covered when attackers seeded fake Cloudflare prompts on more than 700 Ghost CMS sites. One caveat: BleepingComputer reports the HTML it reviewed "does not perform a ClickFix attack." The capability is there; the observed behaviour was redirection.

What Can npm and UNPKG Do About It?

npm can delete the package, and that is where its power ends. The process documented in npm's malware reporting policy is to "Confirm validity of the report", "Remove the package from the registry", "Publish a security placeholder" and "Publish a security advisory alerting the community". That works on code that runs at install, and less well on a file whose only job is to sit on a mirror. OX warns that packages may remain on mirrors after removal from the registry, so the takedown that closes the incident on npm's side can leave the page live on the domain carrying the reputation. UNPKG could refuse to serve HTML with a rendering content type, but that would break every documentation page, demo and playground legitimately served from npm, so the researchers' recommendation lands on defenders instead: treat direct HTML requests to npm mirror domains as suspicious.

What This Means for Your Inbox

Be precise about what the reporting says. No email delivery vector was named for these 24 packages; the pages are reached by opening an unpkg URL in a browser. What it does establish is the target. The August redirect domain, login[.]microsofte[.]live, typosquats Microsoft's login hostname, and researchers noted it was not live when checked, describing it as something that "may be used to host a fake Microsoft login page".

The precedent fills the missing half. In October 2025, Socket documented Beamglea, 175 malicious npm packages with more than 26,000 downloads, using unpkg to host redirect scripts rather than whole pages. Socket found "135+ unique email addresses across 100+ organizations", HTML files themed as purchase orders and project documents, and phishing pages aimed at "Office 365 accounts without multi-factor authentication enabled". Same CDN, same trick, delivered by mail.

So August 2026 is an upgrade, not a novelty. Beamglea needed an HTML attachment that loaded a script from unpkg; this version puts the whole page on the mirror, so a plain link in an email body is enough. That link survives both checks that stop most phishing URLs: it is not a lookalike domain a human would squint at, and it is not on a blocklist. Would a URL pointing at a package CDN clear your mail gateway? It almost certainly would.

What to Do Right Now

The Hacker News listed further package names including ndmxchdjxn2, egair0810, passport811 and @worrisome/reutil. Search your proxy logs for those. The response then splits by who you are.

If you write or ship code:

• Audit what your build pulls from mirrors. Grep templates and bundler config for unpkg.com, npmmirror.com and similar hosts, each serving files at a version you may not have pinned.
• Stop treating CDN reputation as safety. A high scoring domain tells you who runs the server, not who wrote the bytes. Allowlisting a registry mirror allowlists arbitrary attacker content.
• Alert on document requests to mirror domains. A build machine fetching a .js file from unpkg is normal. A browser navigating to unpkg.com and rendering .html is not, and proxy logs show the difference.
• Do not assume a takedown cleaned it up. Confirm the mirror stopped serving the path before closing the ticket.

If you are simply the person clicking:

• A real Cloudflare check never asks you to sign in. It verifies you are human, then shows the page you asked for. A verification screen followed by a login form is the attack.
• Read the address bar, not the page. Page chrome is attacker controlled artwork; the host is the one part of the window they cannot draw. If a page says your Outlook session expired, close it and type outlook.office.com yourself.
• Turn on phishing resistant MFA. Beamglea hunted Office 365 accounts without multi factor authentication specifically, and that selection was not an accident.

One comparison worth sitting with. Microsoft found 14 OpenSearch typosquats stealing CI/CD secrets in May 2026. Every defence that campaign called for, lockfile review, install script auditing, secret rotation, does nothing here. The package never runs, and tooling built to watch installs cannot see a registry being used as a web host.

Sources: BleepingComputer: Hackers abuse npm mirrors to host phishing redirect pages; The Hacker News: 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages; Socket: 175 Malicious npm Packages Host Phishing Infrastructure; UNPKG; npm Docs: Reporting malware in an npm package; Cloudflare: Turnstile get started. Attacker domains are defanged. Details reflect reporting as of 26 August 2026 and the campaign infrastructure may change.