security2 distinct publishers
npm as free hosting: 24 packages whose only job is rendering a fake Cloudflare page
OX Security says the packages were never meant to infect anyone who installs them. Mirrored through unpkg, they serve attacker HTML from a domain most egress policies wave through.
Reality
- Evidence74
- Adoption46
- Hype gap+20
- Incentives62