Phishing Campaign Abuses npm and unpkg Mirrors to Bypass Security Filters

Cybersecurity researchers have uncovered a phishing campaign that weaponizes npm packages and their associated CDN mirrors to host malicious infrastructure. The operation uses trusted developer tools to bypass traditional security filters and deceive end users.

According to Socket's Threat Research Team, the campaign involves the creation of malicious npm packages that host single HTML pages. These pages are designed to mimic Cloudflare CAPTCHA screens, which then redirect victims to "ClickFix"-style phishing infrastructure. While some initial reports identified 24 packages, Socket's research indicates the scale is larger, involving 175 malicious npm packages.

The Mechanics of the Abuse

Unlike traditional supply chain attacks, the primary goal of this campaign is not to infect the developers who install the packages. Instead, the attackers are using the npm registry as a free hosting service. By publishing these packages, the malicious HTML content is automatically mirrored on trusted Content Delivery Networks (CDNs) like unpkg.com.

This allows attackers to send phishing links that point to legitimate, high-reputation domains. Because the content is served from a trusted CDN, it is significantly more likely to bypass domain-based security filters and email gateways that would typically block unknown or suspicious URLs.

Context of 'ClickFix' Attacks

The campaign integrates with the broader "ClickFix" strategy, a social engineering tactic used to trick users into compromising their own systems. These attacks typically present the user with a fake technical error or a CAPTCHA requirement. To "fix" the issue, the victim is prompted to copy and paste a malicious command into their browser's developer console or download a fraudulent software update.

Once the user executes the provided code, the attackers can gain unauthorized access to the system, steal session cookies, or deploy further malware. The use of a fake Cloudflare page adds a layer of perceived legitimacy to the request, making users more likely to comply with the instructions.

Why It Matters

This technique represents a novel abuse of developer infrastructure. By shifting the attack vector from the package code itself to the CDN mirror, the threat actors have found a way to leverage the inherent trust placed in the JavaScript ecosystem. It demonstrates that legitimate tools intended for open-source distribution can be repurposed as stealthy delivery mechanisms for external phishing attacks.

What's Next

Security teams are now tasked with monitoring for unusual patterns of HTML hosting within npm packages. As attackers continue to find ways to exploit the trust associated with CDNs, the industry may need to implement stricter validation for the types of static content allowed to be mirrored from package registries to public-facing URLs.