Attackers Use npm Registry as Free Phishing Infrastructure — 24 Packages Turn Trusted Mirror Domains Into ClickFix Delivery Points

Summary

OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko published findings on August 25, 2026 documenting a campaign in which attackers uploaded 24 empty npm packages containing a single malicious HTML file to the npm registry, exploiting the automatic mirroring behavior of platforms including UNPKG and npmmirror to host fake Cloudflare CAPTCHA pages on trusted developer infrastructure domains. The technique does not infect developers who install the packages. The attack targets a different population: people who receive direct links to the HTML files hosted on mirror domains. Because UNPKG and npmmirror are legitimate, widely used developer platforms, a URL on those domains carries implicit trust that a link to an unknown phishing domain would not. The HTML page impersonates a Cloudflare verification screen. When a visitor opens it, the page contacts attacker-controlled infrastructure and redirects the visitor. At time of publication the redirect destination was the legitimate ChatGPT website, suggesting the infrastructure was being tested rather than actively weaponized. The researchers warn that the destination can be changed to any phishing page, malware download, or credential harvesting infrastructure without modifying the npm packages themselves. Security researcher inf0stache flagged the technique in July using a package called china_airlines. OX identified 24 packages using the same approach in August. Some packages remain available on mirrors after removal from the official npm registry, meaning the phishing infrastructure can persist after the source packages are taken down.

Timeline

Domain Intelligence

Context

npmjs.com scores 87.0 — one of the highest scores in The Trust Observatory's domain intelligence database, reflecting a package registry with strong infrastructure, clean reputation, and substantial network graph position built over more than a decade of serving the JavaScript development community. That high score is precisely what makes this technique operationally effective. Attackers are not exploiting a vulnerability in npm's code. They are exploiting the trust that users place in domains associated with npm's ecosystem. A URL on unpkg.com reads differently to a recipient than a URL on an unknown domain, because unpkg.com is trusted infrastructure. The campaign converts that trust into a delivery mechanism. Treating direct HTML requests to npm mirror domains as potentially suspicious, as OX Security recommends, is a meaningful defensive posture — but it requires security tooling and awareness that most organizations do not apply to developer infrastructure they have implicitly treated as safe.