GKRootWire
Dev Tools Why 'Zero-Cost' Value Classes Still Need Compiler HelpAI Z.ai Unmasked as Creator of Chart-Topping Ox Alpha ModelAI Robotics AI Models Are Finally Leaving Their 'GPT-2 Moment' BehindAI QueryStory Raises $6M to Make AI Answers TrustworthyAI Arga Labs raises $10M to fix how enterprise AI agents get trainedGadgets Startup Legato Exits Stealth With AI-Powered Hearing GlassesDev Tools Why 'Zero-Cost' Value Classes Still Need Compiler HelpAI Z.ai Unmasked as Creator of Chart-Topping Ox Alpha ModelAI Robotics AI Models Are Finally Leaving Their 'GPT-2 Moment' BehindAI QueryStory Raises $6M to Make AI Answers TrustworthyAI Arga Labs raises $10M to fix how enterprise AI agents get trainedGadgets Startup Legato Exits Stealth With AI-Powered Hearing Glasses
Security

Attackers Turn npm Mirrors Into Phishing Launchpads

Malicious HTML pages hosted on npm registry mirrors mimic Cloudflare CAPTCHAs to funnel victims to scam sites.

Security researchers have found threat actors publishing packages to npm that contain fake CAPTCHA verification pages designed to look like Cloudflare's bot-check screens. Because these packages get pulled into public npm mirrors, the malicious HTML ends up hosted on trusted-looking infrastructure, giving phishing links a veneer of legitimacy and helping them slip past spam filters and blocklists.

Visitors who land on these pages, often via links in emails or malicious ads, see what looks like a routine "verify you're human" check before being silently redirected to attacker-controlled sites pushing scams, credential theft, or malware downloads.

npm has reportedly been removing the offending packages as they're identified, but the mirror ecosystem means copies can persist or resurface across other package registries and CDNs that sync from npm.

Why it matters: Abusing package registries as free, reputable web hosting is a growing trick because security tools tend to whitelist domains like npmjs.com and its mirrors. Dev teams should treat unexpected redirects or CAPTCHA pages from registry-adjacent domains with suspicion, and registries need better automated scanning for HTML payloads masquerading as code packages.

Sources: BleepingComputer