Security researchers have identified a campaign that abuses the npm registry and its mirroring services, not to deliver infected packages to developers, but to host phishing redirect pages under the cover of trusted infrastructure.
The technique was first flagged in July by researcher inf0stache, who found a package named ‘china_airlines’ containing a fake Cloudflare verification page that redirected visitors to a malicious domain. IntelFusions also reported on the activity. In a follow-up investigation, OX Security discovered 24 npm packages carrying the same malicious HTML page, distributed across npm and various mirror platforms.
Unlike typical npm supply-chain attacks, installing these packages does not infect a developer’s machine with malware or infostealers. Each package examined contained just two files: an index.html page and a package.json file declaring the HTML as the package’s main entry point.
Mirrors as free web hosting
The abuse hinges on mirroring platforms such as UNPKG and npmmirror, which allow individual files inside a package to be opened directly in a browser. This means the malicious HTML renders from a legitimate domain like unpkg.com rather than attacker-controlled infrastructure, potentially helping the pages slip past security tools that would otherwise block them. OX Security described the effect as turning npm mirrors into free frontend hosting for malicious HTML and potentially other payloads.
The pages themselves impersonate a Cloudflare security check, embedding the legitimate Turnstile CAPTCHA widget. Regardless of whether the verification completes, obfuscated JavaScript on the page redirects visitors elsewhere. OX Security’s Moshe Siman Tov Bustan told BleepingComputer that earlier versions pointed to microcloud[.]homes in July and login[.]microsofte[.]live in August, with some July redirects ultimately landing on the legitimate Microsoft Outlook login page.
Remote-controlled redirects
Some packages have shifted to a more flexible method using api.keyval.org, a legitimate key-value storage service. The page retrieves an encrypted value, decrypts it in the browser, and redirects to whatever URL is stored there, letting attackers change the destination at any time without touching the npm package itself. At the time of OX’s research the destination was ChatGPT’s legitimate site, but researchers warned the same mechanism could just as easily point to credential-phishing pages or malware downloads.
OX also cautioned that removing a package from the npm registry does not guarantee removal from mirrors, which may continue serving cached copies. The researchers recommend treating unsolicited direct HTML requests to npm mirror domains as potentially suspicious activity.