Hackers abuse npm mirrors to host phishing redirect pages

Researchers discovered threat actors abusing npm packages and public npm mirrors to host malicious HTML pages that mimic Cloudflare verification (including embedded Turnstile CAPTCHA) and execute obfuscated JavaScript to redirect visitors to attacker-controlled domains; attackers use the registry and mirror URLs as trusted hosting for phishing pages and can remotely change redirect targets via services like api.keyval.org, potentially enabling credential theft or further malicious redirects.