Attackers are letting npm mirrors host their fake Cloudflare page

OX Security has identified 24 malicious packages on npm that all carry the same HTML page, an imitation of a Cloudflare verification screen. Each package typically picks up between 50 and 300 weekly downloads before it is taken down. Installing one does no damage. The point is not to infect developers, but to use the registry and its mirrors as free hosting for the page. The earliest package in OX Security's own list went up on 4 August 2026, and 17 of the 24 were still live when the findings were published on 25 August.

Mirroring is the heart of this. Packages on npm are automatically mirrored to services such as unpkg, Yarn, npmmirror and Tencent, and some of them expose the individual files inside a package. Anyone can then open the HTML file directly in a browser, at an address that looks entirely ordinary, for example unpkg[.]com/ndmxchdjxn2@1.0.0/index.html. The page presents a fake Cloudflare check and forwards the visitor wherever a remotely controlled value points.

Early packages reached a typosquatted Microsoft domain, login[.]microsofte[.]live. Later versions pull the address from api.keyval.org, a legitimate service that OX Security stresses is not malicious in itself. Right now the redirect lands on a legitimate website, but it can be pointed at a ClickFix lure at any moment. OX Security also calls the OSV and GitHub Advisories description misleading. Those entries say any machine with the package installed should be considered fully compromised, when in practice a victim is only reached after the redirect.

What this means for you if you filter web traffic

If your filtering relies on domain reputation, this walks straight past it. Mirrors like unpkg are services your developers touch every day, and they sit on every allowlist of known-good domains. Our assessment is that this, not the packages themselves, is the real story. The phishing page now sits in the middle of infrastructure you have already chosen to trust, and it is the URL rather than the domain that gives it away.

Note what the blacklisting achieved. The fake Microsoft domain was blocked, and the attacker simply started pulling the destination from a legitimate service instead. Removed does not mean gone, either, because OX Security points out that packages can linger on mirrors long after they are pulled from npm. So a block that rests on the package being gone from the registry protects you for less time than it looks. OX Security expects more of the same, and the reasoning is plain enough: registration and package uploads on npm are free. Our view is that your control has to be a durable detection pattern, not a list of package names.

Berigo recommends

• Treat npm mirrors such as unpkg, npmmirror, Yarn and Tencent as possible phishing addresses whenever the traffic is not a package download.
• Add the mirror URLs to your phishing detection and URL reputation pipelines. Domain reputation alone will not catch this.
• Search proxy logs for requests to mirror domains where the path ends in .html. DNS logs only show that the domain was looked up, so they tell you who visited, not which file they fetched.
• Block login[.]microsofte[.]live. Do not blindly block api.keyval.org, which is a legitimate service. Look instead for lookups against it from machines that have no reason to use one.
• Remind your users that a verification page asking them to copy, paste or run anything themselves is a warning sign, no matter how trustworthy the URL looks.