24 npm Packages Exploit unpkg Mirrors to Host Fake Cloudflare CAPTCHA Phishing Pages

Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor's use of npm isn't to infect developers who install it, but to use the packages as a delivery mechanism for phishing pages.

The attack chain begins when a user loads a page from one of the malicious packages. The HTML page contains code that redirects the visitor to a fake Cloudflare CAPTCHA interface. These fake pages are hosted via unpkg mirrors, a content delivery network for npm packages, which provides the threat actors with free and relatively resilient hosting.

The fake CAPTCHA prompts users to complete actions that align with ClickFix techniques, such as running commands in the terminal or executing PowerShell scripts. This social engineering approach aims to trick users into performing actions that compromise their systems, potentially leading to credential theft or malware installation.

Researchers note that the threat actors are exploiting the trust associated with npm packages and the infrastructure of unpkg mirrors to host their phishing content. The packages themselves are not malicious in a traditional sense; the risk arises from the redirection and the social engineering tactics employed once the page is loaded.

The exact names of the 24 packages have not been detailed in the initial report, but the campaign represents a novel use of the npm registry for phishing infrastructure. Security teams are monitoring the situation and advising users to be cautious when interacting with unfamiliar npm packages or pages that prompt unusual command executions.