Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.
The technique was previously spotted in July by security researcher inf0stache, who found a 'china_airlines' npm package that used a fake Cloudflare verification page to redirect visitors to a malicious domain, and was also reported by IntelFusions.
In a later report, OX Security discovered 24 npm packages containing the same malicious HTML page hosted on npm and various mirrors.
However, unlike the typical npm supply-chain attacks we've seen lately, installing the packages does not infect a developer's computer with malware or infostealers.
Instead, attackers use the npm registry as free storage for malicious HTML pages, which are then copied by mirroring platforms like UNPKG and npmmirror.
Because some of these platforms let individual files in npm packages be accessed directly in a browser, they effectively turn these developer sites into free web hosting for phishing pages.