Attackers Use npm Mirrors to Host Cloudflare CAPTCHA Phishing Redirects
Summary
OX Security found 24 npm packages hosting HTML that mimics Cloudflare Turnstile and redirects browser visitors via npm mirrors. Some pages use api[.]keyval[.]org to retrieve encrypted, remotely changeable redirect URLs; installing the packages does not infect devices.
Key points
- OX Security identified 24 npm packages containing malicious HTML hosted on npm and mirrors such as UNPKG and npmmirror.
- The pages imitate Cloudflare verification and use obfuscated JavaScript to redirect visitors regardless of whether the Turnstile check succeeds.
- Directly opening mirrored package files can serve the HTML from legitimate infrastructure rather than an attacker-controlled host.
- Some versions retrieve an encrypted redirect destination from api[.]keyval[.]org, allowing attackers to change it without republishing the package.
- Earlier redirect destinations included microcloud[.]homes and login[.]microsofte[.]live; researchers said some early redirects led to Microsoft Outlook.
- Installing the packages does not infect a developer’s computer, and BleepingComputer reported that the reviewed HTML did not perform a ClickFix attack.
- Researchers recommend treating direct HTML requests to npm mirror domains as potentially suspicious; packages may remain on mirrors after removal from npm.
Article Details
- Event Type
- Threat actors used npm packages and mirrors to host malicious HTML pages that impersonate Cloudflare verification screens and redirect visitors.
- Impact
- The pages use obfuscated JavaScript to redirect visitors to attacker-controlled destinations. Researchers reported redirects to phishing-related domains and said destinations could be changed remotely; at the time of the research, some redirects led to legitimate Microsoft Outlook or ChatGPT sites. Installing the packages does not, according to the article, infect a developer’s computer.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | login[.]microsofte[.]live | Reported redirect destination used by an earlier version of the malicious page; the article says it may be used to host a fake Microsoft login page. |
| DOMAIN | microcloud[.]homes | Reported attacker-controlled redirect destination used by an earlier version of the malicious page. |
| URL | hxxps[:]//unpkg[.]com/[email protected]/index[.]html | Specific UNPKG-hosted package file that BleepingComputer identified as serving the malicious HTML redirect page. |