Reported by 3 outlets

Timeline

1. original reporting

   24 Malicious npm Packages Abuse Mirror Infrastructure to Host Obfuscated ClickFix Phishing Pages

   cyberpress.org · 48d ago · August 26th, 2026

   Cybersecurity researchers have uncovered 24 malicious npm packages that abuse package mirror services to host obfuscated phishing pages. The packages do not infect a device when a developer downloads or installs them. Instead, the campaign turns trusted npm-related infrastructure into a platform for social engineering. OX Research said each package carried the same HTML file and commonly gained 50 to 300 weekly downloads before removal. The threat actor relies on npm’s distribution ecosystem, where packages are automatically copied to mirrors such as unpkg, Yarn, npmmirror and Tencent. Malicious npm ClickFix Campaign Several mirrors expose individual files contained in a package, rather than only its compressed .tgz archive. A direct link to an HTML file can therefore render a page from the mirror’s own domain. This allows attackers to use well-known, HTTPS-enabled domains as free frontend hosting for phishing content. One observed example was a direct index.html page from the ndmxchdjxn2 package on unpkg. The page displayed a fake Cloudflare verification prompt. Malicious npm ClickFix Campaign (Source: ox) Its objective was not to compromise visitors through npm installation, but to persuade users arriving through a shared link to follow attacker-controlled instructions or redirects. The HTML includes code that displays the fake verification screen and obfuscated JavaScript that contacts a remote service. Early versions queried login[.]microsofte[.]live , a typosquatted Micr

2. update from bleepingcomputer.com

   Hackers abuse npm mirrors to host phishing redirect pages

   bleepingcomputer.com · 49d ago · August 25th, 2026

   The technique was previously spotted in July by security researcher inf0stache , who found a 'china_airlines' npm package that used a fake Cloudflare verification page to redirect visitors to a malicious domain, and was also reported by IntelFusions . In a later report, OX Security discovered 24 npm packages containing the same malicious HTML page hosted on npm and various mirrors. However, unlike the typical npm supply-chain attacks we've seen lately, installing the packages does not infect a developer's computer with malware or infostealers. Instead, attackers use the npm registry as free storage for malicious HTML pages, which are then copied by mirroring platforms like UNPKG and npmmirror. Because some of these platforms let individual files in npm packages be accessed directly in a browser, they effectively turn these developer sites into free web hosting for phishing pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor's use of npm isn't to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware," explains OX Security .

3. update from gbhackers.com

   Hackers Turn Trusted npm Mirrors Into Hosts for Fake Cloudflare ClickFix Pages.

   gbhackers.com · 48d ago · August 26th, 2026

   appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .