npm as free hosting: 24 packages whose only job is rendering a fake Cloudflare page
OX Security says the packages were never meant to infect anyone who installs them. Mirrored through unpkg, they serve attacker HTML from a domain most egress policies wave through.
The Watch · Security desk
What happened
- OX Security says a cluster of npm packages exists only to store a single HTML page, with no attempt to harm anyone who installs it.
- Served through unpkg, that HTML renders as a working fake Cloudflare verification page on a trusted CDN domain.
- The stored destination currently sends visitors to the genuine ChatGPT site, which researchers say can be reconfigured at will.
Why it matters
- constraint CDN mirror domains can no longer be allowlisted wholesale in egress or web filtering, because permitting the host permits attacker-authored pages served from it.
- capability Holding the final hop in a third-party key-value store lets the operator change what the page does without republishing anything to npm or touching the mirror.
- exposure Registry takedown, the remediation lever defenders actually have, does not reach the mirror copy that is doing the hosting.
- decision Link-reputation and sandbox verdicts stop being usable triage inputs here, which pushes the judgement onto whoever writes the mail and proxy rules.
Most of the supply chain tooling in use is aimed at execution: what runs during an install, and what the dependency tree drags in behind it. There is nothing for it to bite on when the package holds a single HTML page and, in OX Security's own words, downloading it would not do harm [7]. The delivery path is not the package manager at all. It is a URL that a mirror serves as a fully rendered page under its own name, with the mirror's certificate and the mirror's reputation attached [9].
That is where blanket allowlisting stops working. A build pulling a script off unpkg and a finance clerk's browser loading `index.html` from the same host are the same domain, the same TLS, the same historical trust score. What separates them is content type and navigation context, and almost nobody writes proxy or egress policy at that granularity. The example path OX gives resolves to `unpkg.com/ndmxchdjxn2@1.0.0/index.html`, which is a package file and a live phishing page at once [9].
The redirect chain shows how cheap the defensive wins are. Early versions called out to a Microsoft login typosquat, `login.microsofte.live` [3]. Chrome's Safe Browsing blocklisted it, and the operator's answer was to point the same page at `api.keyval.org`, a free public key-value store with a REST API, and read the destination out of a stored value [4][5]. Domain blocking now means blocking a legitimate developer service. Worse for anyone relying on URL verdicts: the value currently returns the real ChatGPT site [6], so a sandbox that visits the page reports a clean redirect and keeps reporting it until the key is rewritten.
Scale and duration are the part worth logging. OX counted 24 packages, some still downloadable when the research went out [1][8]. Socket described 175 packages doing the same unpkg-hosting trick in October 2025 under the name Beamglea [11]. That is 199 packages across two disclosed campaigns using one CDN as storage [12]. OX's closing point is the operational one: packages can live indefinitely in mirrors after the official registry removes them [10]. The takedown request that defenders know how to file lands on the registry, not on the cache that is actually serving the page.
What to watch
- Whether unpkg or npm stop serving renderable HTML from package paths, or propagate registry takedowns into mirror caches.
- Whether KeyVal restricts anonymous writes and reads, and whether reputation feeds begin scoring api.keyval.org.
- Whether the stored redirect value flips from the ChatGPT URL to a live ClickFix payload, and how long that takes to be noticed.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Researchers disclosed a campaign using a cluster of 24 npm packages as free phishing infrastructure that redirects to ClickFix-style fake CAPTCHA pages.
- [2]
The HTML page embeds the logic to serve the bogus CAPTCHA verification prompt plus the JavaScript needed to send a request to a remote server.
- [3]
Initial iterations of the malware sent the request to a typosquat domain impersonating the Microsoft login page, login.microsofte.live.
- [4]
After the typosquat domain was added to Google Chrome's Safe Browsing blocklist, the threat actor is said to have switched to KeyVal (api.keyval.org), a free public key-value store that lets developers set or retrieve key-value pairs over a REST API.
- [5]
The switch turns KeyVal into a dead drop resolver used to extract and decode the URL the victim is redirected to.
- [6]
Researchers said the remote logic currently transfers the user to the legitimate ChatGPT website, but could be weaponised to deliver ClickFix or other phishing domains when the attacker configures it to.
- [7]
OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko said the malware is a single HTML page inside the npm package, that downloading it would not do harm, and that the threat actor's use of npm is not to infect developers who install it but to use the registry and its mirrors as safe, validated storage for the malware.
- [8]
Some of the 24 named npm packages were still available for download at the time of the research.
- [9]
The campaign targets mirrors such as unpkg; once mirrored, the HTML file (for example unpkg.com/ndmxchdjxn2@1.0.0/index.html) becomes a live, fully rendered fake Cloudflare CAPTCHA page hosted on a trusted domain that redirects to ClickFix phishing infrastructure.
- [10]
OX Security said npm packages can live forever in mirrors even after they are removed from the official stores, giving the technique persistence, and framed the campaign as infrastructure abuse using npm and its mirrors as free storage.
- [11]
In October 2025, Socket detailed 175 npm packages that used unpkg.com's CDN to host redirect scripts routing victims to credential harvesting pages, in a campaign codenamed Beamglea.
- [12]
The two disclosed campaigns account for 199 npm packages abusing unpkg as hosting.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comHackers abuse npm mirrors to host phishing redirect pages
2 articles · August 26, 2026
- thehackernews.com24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
2 articles · August 25, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.