24 Malicious npm Packages Abuse Trusted Mirrors to Host ClickFix Phishing Pages

Twenty-four malicious npm packages have been used to turn trusted package mirrors into staging points for ClickFix phishing pages.

The campaign does not infect a developer by installing a package. Instead, it exploits the confidence users place in familiar hosting domains to make a phishing page appear safer than it is.

The packages contain a single HTML file that imitates a Cloudflare verification screen. When a person opens that file through a mirrored package URL, the page can contact attacker-controlled infrastructure and redirect the visitor elsewhere.

This creates an indirect attack path, where the registry ecosystem becomes the delivery channel rather than the malware execution point.

Researchers at OX Security identified 24 distinct packages carrying the same malicious page, typically attracting 50 to 300 weekly downloads before removal. 

OX Security said in a report shared with Cyber Security News (CSN) that the activity could potentially deliver ClickFix malware through npm. The finding matters because a removed package may remain available through mirrors.

A visitor who receives a direct link may see the phishing page hosted under a domain associated with package delivery, not an obvious criminal site. This highlights how trusted web infrastructure can be repurposed for social engineering.

24 Malicious npm Packages Abuse Trusted Mirrors

npm packages are automatically copied by services including unpkg, Yarn, npmmirror and Tencent mirrors. Services expose package files directly rather than only the compressed archive.

That means a link to an HTML file can render a complete page in a browser, effectively giving attackers a front end on a recognized domain.

In this case, the malicious HTML presents a fake Cloudflare CAPTCHA and includes scrambled JavaScript. The code requests information from a remote service before deciding where to send the visitor.

The method resembles a separate campaign in which malicious npm packages hosted redirects through unpkg, showing that package mirrors are attractive infrastructure for credential-focused attacks.

The earlier version contacted a Microsoft lookalike domain, while later samples used a legitimate key-value service to retrieve encrypted data.

The remote logic directed users to the real ChatGPT site. Researchers warned that the destination could change to a ClickFix page or another phishing lure, without changing the mirrored package file.

That flexibility is the core concern. ClickFix attacks persuade a victim to copy and run a command, often under the guise of completing a verification check, instead of relying on a browser exploit.

Recent reporting on fake verification page infections shows how such prompts can lead from a familiar-looking challenge to malware and account fraud.

Detection needs a different lens

Security teams should not automatically block every package mirror, since these services support normal development work.

They should, however, treat mirror domains as possible phishing hosts when users are not downloading packages. Adding mirror URLs to phishing and URL-reputation checks can help identify abuse that conventional filters might overlook.

Defenders should also review proxy and DNS records for direct requests to .html files within mirrored packages. Such activity is more suspicious than a routine dependency download, particularly when it comes from employee endpoints without a development role.

The advice aligns with broader coverage of CAPTCHA and ClickFix tactics, which depend on getting users to perform the final harmful action themselves.

For developers, the practical lesson is to be cautious with direct mirror links shared in messages, tickets, adverts or search results. A trusted domain is not proof that every file it serves is safe.

Teams can reduce exposure by validating package names and publishers, limiting access to unneeded public mirrors, and teaching staff never to paste verification commands into a terminal or Run dialog.

The campaign also challenges the assumption that a harmless installation means a harmless package. Here, the package acts as storage for a phishing component, and mirrors may preserve that component after the registry entry disappears.

Similar developer-targeted schemes, including deceptive npm installation messages, reinforce the need to assess package behaviour, hosted files and delivery routes together.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	login[.]microsofte[.]live	Typosquatted Microsoft domain used by the earlier campaign version
Domain	api[.]keyval[.]org	Legitimate key-value service abused to retrieve encrypted redirect data
URL	https://unpkg[.]com/ndmxchdjxn2@1.0.0/index.html	Direct mirror-hosted malicious HTML page
Encoded value	PpihAtpV1i29jeS3Skk7XU74X2Zkd5wyzF2DOzY77k1Fz7GNvGafkxVGs+z6VOGy6E43n+JQgKSUsn+S5NjXlBmcq4=	Encrypted value retrieved through the remote logic
Malicious npm package	bgzxcuite2	Microsoft typosquat family, taken down
Malicious npm package	prezdentkxheiw	Microsoft typosquat family, taken down
Malicious npm package	egair0810	Microsoft typosquat family, taken down
Malicious npm package	mnteckets	Microsoft typosquat family, taken down
Malicious npm package	airdzticket	Microsoft typosquat family, taken down
Malicious npm package	egypt0811	Microsoft typosquat family, taken down
Malicious npm package	passport811	Microsoft typosquat family, taken down
Malicious npm package	vxhjkseuiaqkb	Microsoft typosquat family
Malicious npm package	ndmushdkeqe	Microsoft typosquat family
Malicious npm package	ndmxchdjxn2	Microsoft typosquat family
Malicious npm package	ndmfguyhoxc3	Microsoft typosquat family
Malicious npm package	mjsdqwocvn	Microsoft typosquat family
Malicious npm package	m2fcsfyjkuxb	Microsoft typosquat family
Malicious npm package	m3fdfocdoewn	Microsoft typosquat family
Malicious npm package	@worrisome/reutil	keyval new-logic family
Malicious npm package	testdgdbcsd	Microsoft typosquat family
Malicious npm package	tesgfvbncsdbcv	Microsoft typosquat family
Malicious npm package	mndsxcusiwlk1	keyval new-logic family
Malicious npm package	mn2adskhweox	keyval new-logic family
Malicious npm package	mn3sadkoiewu	keyval new-logic family
Malicious npm package	mn4xcouzvhus	keyval new-logic family
Malicious npm package	mbxcnsuwgs1	keyval new-logic family
Malicious npm package	skxcmwuncbg2	keyval new-logic family
Malicious npm package	mobiwaefhxc3	keyval new-logic family

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC