Hackers Turn Trusted npm Mirrors Into Hosts for Fake Cloudflare ClickFix Pages.

OX Security identified a campaign of 24 malicious npm packages that host identical HTML impersonating Cloudflare verification pages on trusted npm mirrors (e.g., unpkg.com). The packages act as disposable hosting for phishing pages that contact attacker-controlled infrastructure or remote key-value services to determine redirect destinations; while current redirects led to benign sites, the technique can enable credential phishing, ClickFix social-engineering flows, or malware delivery. Security teams are advised to treat direct .html requests to npm mirrors as suspicious, review proxy/DNS/secure web gateway logs for package-version paths ending in .html, and warn users never to run OS commands prompted by in-browser CAPTCHAs.