A new wave of attacks is exploiting the **npm** registry and its mirrors to host malicious HTML pages, turning these trusted developer platforms into free frontends for phishing campaigns. Unlike typical **npm** supply-chain attacks that infect developers' systems upon package installation, this method uses **npm** as a validated storage mechanism for malicious web content. The technique was first identified in July by a security researcher who discovered a 'china_airlines' **npm** package employing a fake **Cloudflare** verification page. This finding was corroborated by **IntelFusions**, and subsequently, **OX Security** uncovered 24 additional **npm** packages containing similar malicious HTML pages. ### NPM as a Phishing Host **OX Security** elaborates that the attackers' objective isn't to compromise developers who install the packages. Instead, they exploit the **npm** registry and its mirrors, such as **UNPKG** and **npmmirror**, as reliable, legitimate storage for their malicious HTML. These mirroring platforms often allow direct browser access to individual files within **npm** packages, effectively transforming them into free web hosting services for phishing content. BleepingComputer's analysis of one such package revealed it contained only an `index.html` file and a `package.json` file, with the HTML declared as the package's main entry.  When mirrored, the HTML file can be accessed directly via a URL like `https://unpkg[.]com/[email protected]/index[.]html`. This renders the attacker's HTML from a legitimate domain like unpkg.com, potentially bypassing security software that might block known malicious infrastructure. ### Malicious HTML: A Redirector with Evolving Tactics The malicious HTML pages are designed to mimic **Cloudflare** security verification pages, embedding legitimate **Cloudflare Turnstile CAPTCHA** services. Regardless of the CAPTCHA outcome, the page executes heavily obfuscated JavaScript to redirect the visitor.  **Moshe Siman Tov Bustan**, research team lead at **OX Security**, noted that early versions redirected to domains like `microcloud[.]homes` and `login[.]microsofte[.]live`. Some of the July redirects ultimately led to the legitimate **Microsoft Outlook** mail login site. Later iterations of the attack adopted a more sophisticated redirect mechanism, utilizing `api.keyval.org`, a legitimate platform for storing key-value pairs. This method retrieves an encrypted value from the service, decrypts it in the browser, and then redirects the visitor to the decrypted URL. This allows attackers to remotely alter the redirect destination without modifying or republishing the **npm** package itself. At the time of **OX Security**'s research, some redirects pointed to the legitimate **ChatGPT** website. While these pages could be reconfigured to point to phishing sites, malware downloads, or other malicious destinations, **OX Security** also cautions that packages removed from the official **npm** registry may persist on mirrors, extending their potential threat window. Security professionals are advised to treat direct HTML requests to **npm** mirror domains with suspicion, as threat actors continue to innovate in their use of legitimate infrastructure for malicious purposes.