Cybersecurity researchers have uncovered a new abuse technique that takes advantage of npm mirror abuse: threat actors hide a simple HTML page inside multiple npm packages, then rely on mirror services (especially unpkg) to host that content on a domain people trust.
Although the malicious payload is described as only an HTML file inside each package—and downloading it alone won’t automatically harm a developer—what makes the campaign dangerous is the way the infrastructure is used. Instead of aiming to infect developers, the attackers use npm’s public ecosystem to “store” and deliver a working phishing interface to end users via mirrors.
How npm mirror abuse works in practice
The campaign centers on a cluster of 24 npm packages that are repurposed as free phishing delivery infrastructure. Researchers from OX Security explain that the HTML page is the core element, and its purpose is to present a fake verification step that looks legitimate.
In other words, the attackers aren’t necessarily trying to exploit developers who install the packages. Their goal is to make the mirrored content available as a live web page on trusted delivery networks, where users are more likely to engage with it.
Mirrors turn stored files into live web pages
Once a package is mirrored on services like unpkg, the file becomes accessible as a rendered webpage. A typical example described by the researchers looks like this pattern: unpkg[.]com/package-name@1.0.0/index.html.
From there, the browser loads a page designed to behave like a widely recognized security check—specifically a fake Cloudflare CAPTCHA-style prompt.
The fake Cloudflare CAPTCHA redirect loop
When a target opens a link that points to one of these mirrored HTML pages, the page displays a bogus “verification” experience. After the prompt, the victim is redirected to attacker-controlled phishing infrastructure.
Researchers note that the HTML also contains the logic and supporting JavaScript needed to contact a remote server. This remote component is used to decide where to send the victim next.
Why this matters for real users
The risk is aimed at anyone who clicks a crafted link. Because the content is served from a mirror that users may associate with standard npm distribution, the initial landing can appear more credible than a direct visit to a suspicious domain.
Once the fake verification page runs, the victim can be pushed toward unintended actions—up to the point of being delivered to a phishing site.
Typosquatted login domains and the move to KeyVal
Early iterations of the malware reportedly sent requests to a typosquatted domain impersonating a Microsoft login page, referenced as login[.]microsofte[.]live. This kind of naming technique is common in phishing campaigns because it visually resembles a legitimate brand while pointing to an attacker-controlled destination.
However, the researchers report that after the domain was added to Google Chrome’s Safe Browsing blocklist, the campaign adapted.
Using KeyVal as a “dead drop resolver”
Instead of relying on the previously blocked typosquat domain, the threat actor is said to have switched to api.keyval[.]org, a public key-value store service.
The key detail is how the legitimate service is repurposed. By storing or retrieving a value through a REST API, the attacker effectively turns the platform into a dead drop resolver (DDR). The malicious page can extract and decode the URL to which the victim is redirected.
That way, the phishing campaign can change destinations without having to replace the mirrored HTML content every time.
Current behavior and potential for weaponization
According to the researchers, the remote logic currently transfers users to the legitimate ChatGPT website. They add, however, that this behavior is not fixed.
The same infrastructure—configured through the remote component—could be adapted to deliver ClickFix phishing or other phishing domains. That means the “destination” can be updated based on attacker decisions, while the mirrored entry point remains unchanged.
For defenders, this is an important shift: even if one observed redirect looks benign at the moment, the underlying delivery mechanism can still be used for harm later.
The specific npm packages highlighted in the report
Researchers provided a list of the involved npm package names. Some were still available for download at the time the analysis was published. The packages include:
- bgzxcuite2
- prezdentkxheiw
- egair0810
- mntectets
- air dzticket
- egypt0811
- passport811
- vxhjkseuiaqkb
- ndmushdkeqe
- ndmxchdjxn2
- ndmfguyhoxc3
- mjsdqwocvn
- m2fcsfyjkuxb
- m3fdfocdoewn
- @worrisome/reutil
- testdgdbcsd
- tesgfvbncsdbcv
- mndsxcusiwlk1
- mn2adskhweox
- mn3sadkoiewu
- mn4xcouzvhus
- mbxcnsuwgs1
- skxcmwuncbg2
- mobiwaefhxc3
Note: Package names can be easy to imitate, and mirror-hosted content can be accessed through predictable URL formats. Treat unexpected links carefully, even if they appear to be hosted in a familiar npm-related ecosystem.
This isn’t the first infrastructure abuse campaign
OX Security emphasizes that this approach builds on a recurring trend: attackers look for new ways to use legitimate services to store payloads and data, rather than only relying on classic malware delivery.
They also point to a prior example from October 2025, when Socket described 175 npm packages abused unpkg as a CDN to host redirect scripts. In that campaign (codenamed Beamglea), victims were routed toward credential-harvesting pages.
The broader takeaway is that malware delivery doesn’t always fit a single pattern of “infect the machine.” Sometimes the threat lies in infrastructure abuse—using trusted distribution and storage systems as long-lived hosting layers.
What users and developers should do
If you’re a developer, the instinct may be to focus only on whether a package “does harm when installed.” This campaign highlights a different angle: links to mirrored content can be weaponized even when the package itself is not obviously dangerous to install.
Practical steps include:
- Be cautious with unexpected npm/unpkg links, especially those tied to verification or CAPTCHA-style prompts.
- Verify the origin before clicking. If you didn’t request a “verification,” assume it could be phishing.
- Rely on browser protections (like Safe Browsing), but don’t treat them as a guarantee.
- Watch for redirect behavior after a prompt. Fake verification pages often route users to external sites.
Conclusion: trust the package, not the mirror link
npm mirror abuse demonstrates how attackers can repurpose npm packages as delivery containers by leveraging mirror services like unpkg. The payload may be “just HTML,” but that HTML can power convincing fake CAPTCHA experiences and redirect victims toward phishing infrastructure—sometimes with adaptable destinations.
As attackers keep evolving their infrastructure tactics, the safest mindset is to treat mirrored links with skepticism, particularly when they ask users to verify identity or complete an action unexpectedly.
Source: https://thehackernews.com/2026/08/24-npm-packages-abuse-unpkg-mirrors-to.html
