Hackers litter NPM with packages that don’t infect computers – they host phishing pages instead
Scammers are exploiting the open source community to host phishing sites.
Phishing page impersonating Microsoft. Image by Cybernews.
- Hackers uploaded empty NPM packages with phishing HTML pages that mirrors automatically host on trusted domains.
- OX Security found at least 24 packages showing fake Cloudflare CAPTCHA pages that redirect victims to malware sites.
- Some phishing domains were blacklisted, but mirrored packages may stay online and be reused with new domains.
- The campaign shows attackers using trusted developer infrastructure to evade detection and spread supply chain threats.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Hackers have struck another gold mine on NPM: drop a package, and phishing pages like “Microsofte” or “Microlive” pop up across the web. Attackers exploit NPM mirrors as free hosting for legitimate-looking HTML pages.
Dozens of weird packages are appearing on NPM that don't make sense at first glance. They do nothing useful, nor anything obviously malicious – install them and all you get is an HTML page.
But that’s the whole point – attackers are leveraging NPM mirrors as a free hosting.
Whenever a new NPM package is uploaded, it is automatically picked up by unpkg, Yarn, npmmirror, Tencent, and other mirrors. Many of these mirrors expose the package’s individual files directly on the internet, rather than serving the entire package as an archive.
This way, phishers can use highly reputable domains to bypass detection.
OX Security, an application security platform, flagged 24 NPM packages and counting, all containing a single HTML file. Once mirrored by unpkg and other NPM mirrors, that file becomes a live, fully-rendered fake Cloudflare CAPTCHA page.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Attackers can then disseminate links in various ways, from sending them directly to victims via DMs or email to using malicious advertising campaigns.
“Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data,” Ox said in the report on the discovery of phishing pages.
Anyone who clicks the link sees a fake “security verification” and is then redirected to a fake website that attempts to deliver malware. Some of the phishing domains used in the malicious campaign include login[.]microsofte[.]live, login[.]microlive[.]org, and likely others.
The domains were already blacklisted after the first wave of malware, Ox Security noted, but many of the packages remain live, and attackers can update them with new domains or publish new NPM packages, weaponized to deliver other scams, such as ClickFix.
“In later versions of the malware, it uses a different domain name – https://api.keyval.org – a legitimate domain used to store key-value pairs, which the threat actor is using to get an encrypted value from the remote server and decrypt it – then loads the URL and browses to it,” the report reads.
NPM has recently been the epicenter of supply chain attacks, with attackers targeting developers by embedding malware in fake or compromised packages.
Using NPM’s mirrors as free payload storage and hosting is a novel approach by threat actors – some packages can remain live nearly forever in mirrors, long after the official NPM repository removes them.