24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

OX Security researchers disclosed a campaign that uploaded 24 npm packages containing single HTML pages which, when served via mirrors like unpkg, render fake Cloudflare CAPTCHA pages and redirect victims to credential-harvesting infrastructure; the actor has switched from a typosquat Microsoft domain to using api.keyval.org as a dead-drop resolver to control redirect targets, and several packages remain available—demonstrating infrastructure abuse of trusted package/CDN mirrors to host persistent phishing pages.