npm Mirror Phishing Redirect Campaign
First seen Aug 26, 2026 · Updated Aug 26, 2026
Threat actors are abusing npm and its mirror services to host malicious HTML pages that impersonate Cloudflare CAPTCHA verification screens. Visitors who interact with these fake pages are redirected to attacker-controlled sites, likely for further phishing, malware delivery, or credential theft. The abuse leverages the inherent trust and reachability of npm's infrastructure to evade detection and blocklisting.
Technical Analysis
Attackers are uploading npm packages containing crafted HTML/JS files that mimic Cloudflare's CAPTCHA/challenge interstitials, hosting them on npm's CDN and third-party mirror services which are widely trusted and rarely blocked by web filters. When visited, these pages execute redirect logic (via JavaScript or meta-refresh) to send victims to attacker-controlled phishing or malware-delivery domains. Because npm and its mirrors are commonly whitelisted in corporate proxies and automated build/CI pipelines, the redirect pages can bypass reputation-based security controls. Developers and automated systems—including AI coding agents and CI/CD pipelines that programmatically fetch or reference npm package contents (e.g., for dependency resolution, README rendering, or automated vulnerability scanning)—could inadvertently render or fetch these malicious pages, exposing credentials or triggering unwanted redirects within agent-driven tooling. Organizations running autonomous coding agents or package-analysis agents that crawl npm registries should treat fetched HTML/documentation content as untrusted and sandbox rendering.
Affected Systems
npm registry package hosting, npm mirror/CDN services, any web browser or automated crawler rendering npm-hosted HTML content, CI/CD pipelines that fetch npm package assets
Indicators of Compromise
- Malicious HTML pages hosted on npm package pages mimicking Cloudflare CAPTCHA
- Redirect chains to attacker-controlled domains (specific domains not disclosed in source)
- npm mirror URLs serving fake verification content
Remediation Steps
- 1
Restrict automated fetching of npm-hosted HTML
Configure CI/CD and agent-based tooling to avoid rendering or executing HTML/JS content fetched from npm package pages or mirrors without sandboxing.
- 2
Monitor for anomalous redirects
Deploy web filtering/DNS monitoring to detect redirect chains originating from npm domains to unfamiliar external sites.
- 3
Audit npm dependency sources
Verify integrity and legitimacy of packages before installation; avoid pulling packages solely to render embedded HTML/documentation.
- 4
User awareness training
Educate developers and security teams that even trusted platforms like npm can host abused content, and to scrutinize CAPTCHA pages for legitimacy.
- 5
Report and takedown
Report malicious packages/pages to npm security team for removal and blocklist known malicious redirect domains once identified.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.