Loading today’s stories
Security2 distinct publishers2 min readPublished
OX Security says the packages were never meant to infect anyone who installs them. Mirrored through unpkg, they serve attacker HTML from a domain most egress policies wave through.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Most of the supply chain tooling in use is aimed at execution: what runs during an install, and what the dependency tree drags in behind it. There is nothing for it to bite on when the package holds a single HTML page and, in OX Security's own words, downloading it would not do harm [2]. The delivery path is not the package manager at all. It is a URL that a mirror serves as a fully rendered page under its own name, with the mirror's certificate and the mirror's reputation attached [4].
That is where blanket allowlisting stops working. A build pulling a script off unpkg and a finance clerk's browser loading `index.html` from the same host are the same domain, the same TLS, the same historical trust score. What separates them is content type and navigation context, and almost nobody writes proxy or egress policy at that granularity. The example path OX gives resolves to `unpkg.com/[email protected]/index.html`, which is a package file and a live phishing page at once [4].
The redirect chain shows how cheap the defensive wins are. Early versions called out to a Microsoft login typosquat, `login.microsofte.live` [6]. Chrome's Safe Browsing blocklisted it, and the operator's answer was to point the same page at `api.keyval.org`, a free public key-value store with a REST API, and read the destination out of a stored value [7][8]. Domain blocking now means blocking a legitimate developer service. Worse for anyone relying on URL verdicts: the value currently returns the real ChatGPT site [9], so a sandbox that visits the page reports a clean redirect and keeps reporting it until the key is rewritten.
Scale and duration are the part worth logging. OX counted 24 packages, some still downloadable when the research went out [1][3]. Socket described 175 packages doing the same unpkg-hosting trick in October 2025 under the name Beamglea [10]. That is 199 packages across two disclosed campaigns using one CDN as storage [12]. OX's closing point is the operational one: packages can live indefinitely in mirrors after the official registry removes them [11]. The takedown request that defenders know how to file lands on the registry, not on the cache that is actually serving the page.
Ranked by verification strength, evidence, and original report placement.
Researchers disclosed a campaign using a cluster of 24 npm packages as free phishing infrastructure that redirects to ClickFix-style fake CAPTCHA pages.
Some of the 24 named npm packages were still available for download at the time of the research.
OX Security researchers Moshe Siman Tov Bustan and Vitalii Chepurko said the malware is a single HTML page inside the npm package, that downloading it would not do harm, and that the threat actor's use of npm is not to infect developers who install it but to use the registry and its mirrors as safe, validated storage for the malware.
The HTML page embeds the logic to serve the bogus CAPTCHA verification prompt plus the JavaScript needed to send a request to a remote server.
Initial iterations of the malware sent the request to a typosquat domain impersonating the Microsoft login page, login.microsofte.live.
After the typosquat domain was added to Google Chrome's Safe Browsing blocklist, the threat actor is said to have switched to KeyVal (api.keyval.org), a free public key-value store that lets developers set or retrieve key-value pairs over a REST API.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Mechanism well documented, impact not
The hosting technique is concretely evidenced: named researchers, a full package list, a reproducible mirrored URL pattern, and hands-on verification by a second publisher that inspected package contents and loaded a live mirrored page. What is missing is any victim-side data -- no click, delivery, or compromise telemetry -- and the ClickFix payload characterisation is contradicted by the only independent inspection in the cluster.
Technique recurring, scale unproven
Attacker uptake is demonstrable and repeated: 24 live-mirrored packages now, 175 in Socket's Beamglea set in October 2025, and an earlier July sighting reported by a third researcher. But adoption is measured only in packages published, not in victims reached; no impressions, click-through, credential-theft or blocked-request figures appear in any source, and the currently configured destination was benign.
Payload framing outruns observation
Mildly overstated. Headlines and the vendor framing lead with ClickFix-style phishing and malware delivery, while the observed behaviour was a redirect to the legitimate ChatGPT site, an earlier redirect to a now-dead Microsoft typosquat, and no ClickFix interaction in the one page independently reviewed. The underlying hosting-abuse and mirror-persistence findings are, by contrast, well supported and arguably underplayed relative to the payload language.
Vendor-originated research, promoted context
All primary findings come from commercial security vendors with a product interest in supply-chain and registry risk: OX Security supplies the disclosure and its named researchers, and the corroborating precedent is Socket's Beamglea report. Neither npm, UNPKG, npmmirror nor KeyVal is quoted in response. One publisher's page also carries a promoted vendor report appended to the article body, further mixing research and marketing context.
Solid on mechanism, thin on effect
Two distinct publishers, one of which reproduced the artefact, give good confidence in the technique, the package list and the KeyVal dead drop. Confidence is held back by single-vendor origin for the underlying research, the unresolved dispute over the ClickFix label, absence of any platform or registry statement, and no measurement of real-world victim impact.
security
A year of Sophos AI cases: 30 of 38 were fake installers, not autonomous attackers1 distinct publisher
build
The npm audit that works because it never installs the package1 distinct publisher
security
A manifest edit, not a code edit: North Korea backdoored three Rust crates via typosquat1 distinct publisher
product
The arrayref compromise turned cargo update into the delivery channel1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 25, 2026
2 articles · August 25, 2026