24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
- ID
- 17595
- Status
- summarized
- Published
- 25 Aug 2026, 7:52 PM
- Fetched
- 25 Aug 2026, 8:36 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/24-npm-packages-abuse-unpkg-mirrors-to.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 8.0
- Created
- 25 Aug 2026, 8:38 PM
- Tags
- Audience
- developersvibe_coders
What happened
24 npm packages are using unpkg mirrors to host fake Cloudflare CAPTCHA pages for ClickFix phishing. The packages do not infect developers who install them; instead, they use the npm registry as free, trusted hosting for malicious HTML files. The campaign recently switched to using the KeyVal key-value store as a dead drop resolver to evade Google Chrome's Safe Browsing blocklist.
Why it matters
Developers should audit unpkg.com URLs in their applications and be aware that npm package mirrors can be abused to host active phishing infrastructure on trusted domains. If you use unpkg to serve dependencies, verify package integrity and monitor for unexpected HTML files.
Discussion angle
How to detect and block malicious npm packages that use legitimate registries and mirrors as free hosting for phishing campaigns.