Threat Actors Use npm and Mirror Sites to Host Phishing Pages and Redirect Users

466/69 Thursday, August 27, 2026 Reports indicate that threat actors have abused the npm package registry and websites that mirror package data as hosting locations for malicious HTML files. These webpages are designed to impersonate Cloudflare CAPTCHA verification pages to deceive visitors and redirect them to attacker-controlled websites. The incident is notable because it differs from typical supply chain attacks. Installing these packages does not directly infect developers’ computers with malware. Instead, the attackers use trusted infrastructure such as npm as free storage for phishing pages. Investigation found that suspicious packages often contain only two files: index.html and package.json . One observed package structure was associated with the package name ndmxchdjxn2 . When users opened the link through platforms such as UNPKG, the browser displayed a fake Cloudflare security verification page. By relying on a legitimate domain such as unpkg.com , attackers could bypass security systems that may otherwise block malicious websites. In addition, embedded code behind the page redirected users to other websites. Initial activity was linked to fake login pages, while later techniques were updated to retrieve encrypted redirect destinations from external platforms. This method allows attackers to change the final destination, such as fake automated interaction pages or malware download pages, at any time without updating the original package. Experts stated that threat actors continue to seek new ways to abuse legitimate infrastructure to hide their activity. Administrators and users should be aware that these malicious packages may remain on mirror sites even after being removed from the main npm registry. To reduce risk, organizations and network administrators should increase monitoring of direct requests for HTML files served from these domains. If suspicious activity is detected, they should consider restricting access or closely monitoring abnormal redirection behavior to prevent users in the organization from falling victim to phishing attacks.