24 Malicious npm Packages Abuse Registry Mirrors as Phishing Infrastructure (Fake Cloudflare/Microsoft Login Pages) — Threadlinqs Intelligence
As of 2026-08-26, 24 Malicious npm Packages Abuse Registry Mirrors as Phishing Infrastructure (Fake Cloudflare/Microsoft Login Pages) is a medium-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-2150 · Severity: MEDIUM · Status: ACTIVE · Category: SUPPLY_CHAIN
OX Security identified 24 npm packages (published 2026-08-04 to 2026-08-24) whose only payload is a single HTML file impersonating a Cloudflare Turnstile verification screen; obfuscated JavaScript in
Security researcher inf0stache first spotted this technique in July 2026 in an npm package named 'china_airlines,' which rendered a fake Cloudflare verification page and redirected visitors to the attacker domain microcloud[.]homes. In August 2026, OX Security identified a much larger, related cluster of 24 npm packages published between August 4 and August 24, 2026 (e.g. bgzxcuite2, prezdentkxheiw, ndmxchdjxn2, @worrisome/reutil) that repeat the same pattern: each package contains almost nothing but a single index.html styled as a Cloudflare Turnstile CAPTCHA or a Microsoft login page, plus a package.json. Installing or importing these packages does not execute code or infect a developer's machine — OX Security explicitly notes the threat actor's use of npm 'isn't to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware.' The danger is that mirror services (unpkg, npmmirror, Yarn's registry mirror, and Tencent Cloud's npm mirror) expose individual package files directly over HTTP(S), so a URL like https://unpkg.com/ndmxchdjxn2@1.0.0/index.html renders as a live, fully-functional phishing page hosted on a trusted, high-reputation CDN domain — one that bypasses reputation-based web filtering and survives npm registry takedowns because mirror copies of a removed package persist indefinitely.
The obfuscated JavaScript embedded in the HTML does not hardcode its final destination. The earliest observed variant redirected to the typosquatted domain login[.]microsofte[.]live (a fake Microsoft login lure); the current variant instead queries api.keyval.org, a legitimate free key-value storage API, to fetch an attacker-controlled redirect URL at runtime — a dead-drop resolver pattern (MITRE T1102.001) that lets the operators rotate the phishing/redirect destination without republishing or modifying the npm package itself. At the time of OX Security's research the resolved destination pointed to the legitimate ChatGPT website, which the researchers characterize as inert/benign staging rather than the final intended use — they explicitly warn the same infrastructure 'could be weaponized to deliver ClickFix or any other phishing domains.' The explicit reference to ClickFix (MITRE T1204.004, User Execution: Malicious Copy and Paste) signals the intended endgame: using the fake-CAPTCHA page as a lure to get victims to copy-paste and execute an attacker-supplied command, a technique that has driven recent Latrodectus, Lumma Stealer, and NetSupport RAT infections industry-wide.
Severity nuance: GitHub Security Advisory GHSA-35pm-fj6m-m6v6 / OSV MAL-2026-13785, issued for one of the packages (bgzxcuite2, published 2026-08-12), classifies it under CWE-506 (Embedded Malicious Code) and states systems with it installed should be considered 'fully compromised' — OX Security's own analysis contradicts this blanket framing, clarifying that installing the packages is harmless and victims can only be affected after being lured to open the rendered HTML and then following a subsequent ClickFix or credential-phishing flow. This is a live, low-noise campaign (each package saw only 50-300 weekly downloads before removal) that functions as reusable phishing infrastructure rather than a conventional software-supply-chain compromise; it is conceptually related to, but distinct from, the October 2025 'Beamglea' campaign (175 npm packages, documented by Socket) that abused the unpkg CDN in a similar way for credential-harvesting redirects.
Weaknesses (CWE)
CWE-506, CWE-451
Target sectors: technology, cross-sector
Target regions: Global
Timeline
- Security researcher inf0stache first identifies the npm package 'china_airlines' using a fake Cloudflare verification page that redirects visitors to the attacker-controlled domain microcloud[.]homes — the earliest known variant of this technique.
- Publication window begins for the cluster of 24 malicious npm packages later identified by OX Security (window: 2026-08-04 to 2026-08-24).
- GitHub Security Advisory GHSA-35pm-fj6m-m6v6 and OSV report MAL-2026-13785 are published for the npm package bgzxcuite2@1.0.0, classifying it as embedded malicious code (CWE-506).
- Publication window for the 24-package cluster closes; by this point redirect infrastructure has shifted from the hardcoded typosquat domain login[.]microsofte[.]live to the legitimate key-value API api.keyval.org used as a dead-drop resolver.
- OX Security publishes research disclosing the full 24-package campaign, the mirror-abuse hosting technique, and its connection to the ClickFix (T1204.004) social-engineering pattern.
- The Hacker News and BleepingComputer publish independent coverage of the OX Security findings, contextualizing it alongside the related October 2025 'Beamglea' 175-package npm/unpkg mirror-abuse campaign documented by Socket.
- Cyber Security News publishes coverage of the campaign, the article that triggered this threat record.
- npm removes a subset of the identified packages (e.g. bgzxcuite2, prezdentkxheiw, egair0810, mnteckets, airdzticket, egypt0811, passport811) from the registry; researchers confirm mirror copies on unpkg, npmmirror, and the Tencent Cloud npm mirror remain live and reachable after takedown, while several other packages in the cluster remain live on npm itself.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, MEDIUM, threat intelligence, cybersecurity, T1583, T1608, T1195, T1566, T1204, T1036, T1027
