24 Malicious npm Packages Abuse Registry Mirrors as Phishing Infrastructure (Fake Cloudflare/Microsoft Login Pages)
24 Malicious npm Packages Abuse Registry Mirrors as Phishing (TL-2026-2150) is a medium-severity supply-chain compromise, first published 2026-08-26. It has no confirmed attribution, affects npm, Inc. / OpenJS Foundation npm public registry and its downstream, maps to 7 MITRE ATT&CK techniques (T1027, T1036, T1195), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-2150
- Threat ID
- TL-2026-2150
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-26
- Last reviewed
- 2026-08-26
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cross-sector
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in 24 Malicious npm Packages Abuse Registry Mirrors as Phishing
Malware and tooling: Cloudflare Turnstile (spoofed UI)
OX Security identified 24 npm packages (published 2026-08-04 to 2026-08-24) whose only payload is a single HTML file impersonating a Cloudflare Turnstile verification screen; obfuscated JavaScript in the page queries a redirect target and sends visitors on to phishing or attacker-chosen infrastructure. The technique abuses npm/unpkg/npmmirror/Tencent mirrors as free, takedown-resistant hosting and has evolved from a hardcoded typosquat domain to a legitimate key-value service used as a dead-drop resolver.
How 24 Malicious npm Packages Abuse Registry Mirrors as Phishing works
Security researcher inf0stache first spotted this technique in July 2026 in an npm package named 'china_airlines,' which rendered a fake Cloudflare verification page and redirected visitors to the attacker domain microcloud[.]homes. In August 2026, OX Security identified a much larger, related cluster of 24 npm packages published between August 4 and August 24, 2026 (e.g. bgzxcuite2, prezdentkxheiw, ndmxchdjxn2, @worrisome/reutil) that repeat the same pattern: each package contains almost nothing but a single index.html styled as a Cloudflare Turnstile CAPTCHA or a Microsoft login page, plus a package.json. Installing or importing these packages does not execute code or infect a developer's machine — OX Security explicitly notes the threat actor's use of npm 'isn't to infect developers who install it, but to use the registry and its mirrors as a safe, validated storage for the malware.' The danger is that mirror services (unpkg, npmmirror, Yarn's registry mirror, and Tencent Cloud's npm mirror) expose individual package files directly over HTTP(S), so a URL like https://unpkg.com/ndmxchdjxn2@1.0.0/index.html renders as a live, fully-functional phishing page hosted on a trusted, high-reputation CDN domain — one that bypasses reputation-based web filtering and survives npm registry takedowns because mirror copies of a removed package persist indefinitely.
The obfuscated JavaScript embedded in the HTML does not hardcode its final destination. The earliest observed variant redirected to the typosquatted domain login[.]microsofte[.]live (a fake Microsoft login lure); the current variant instead queries api.keyval.org, a legitimate free key-value storage API, to fetch an attacker-controlled redirect URL at runtime — a dead-drop resolver pattern (MITRE T1102.001) that lets the operators rotate the phishing/redirect destination without republishing or modifying the npm package itself. At the time of OX Security's research the resolved destination pointed to the legitimate ChatGPT website, which the researchers characterize as inert/benign staging rather than the final intended use — they explicitly warn the same infrastructure 'could be weaponized to deliver ClickFix or any other phishing domains.' The explicit reference to ClickFix (MITRE T1204.004, User Execution: Malicious Copy and Paste) signals the intended endgame: using the fake-CAPTCHA page as a lure to get victims to copy-paste and execute an attacker-supplied command, a technique that has driven recent Latrodectus, Lumma Stealer, and NetSupport RAT infections industry-wide.
Severity nuance: GitHub Security Advisory GHSA-35pm-fj6m-m6v6 / OSV MAL-2026-13785, issued for one of the packages (bgzxcuite2, published 2026-08-12), classifies it under CWE-506 (Embedded Malicious Code) and states systems with it installed should be considered 'fully compromised' — OX Security's own analysis contradicts this blanket framing, clarifying that installing the packages is harmless and victims can only be affected after being lured to open the rendered HTML and then following a subsequent ClickFix or credential-phishing flow. This is a live, low-noise campaign (each package saw only 50-300 weekly downloads before removal) that functions as reusable phishing infrastructure rather than a conventional software-supply-chain compromise; it is conceptually related to, but distinct from, the October 2025 'Beamglea' campaign (175 npm packages, documented by Socket) that abused the unpkg CDN in a similar way for credential-harvesting redirects.
MITRE ATT&CK techniques used in TL-2026-2150
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Initial Access
T1195 Supply Chain Compromise; T1566 Phishing
Execution
Resource Development
Affected products and versions in 24 Malicious npm Packages Abuse Registry Mirrors as Phishing
- npm, Inc. / OpenJS Foundation — npm public registry and its downstream CDN mirrors (unpkg, npmmirror, Tencent Cloud npm mirror, Yarn registry mirror)
Vulnerable versions: 24 malicious packages published 2026-08-04 to 2026-08-24 (e.g. bgzxcuite2@1.0.0, ndmxchdjxn2@1.0.0, @worrisome/reutil); china_airlines (July 2026 precursor variant identified by inf0stache)
Fixed in: Not applicable — mitigated only by npm registry takedown of individual packages; no patch exists for copies already replicated to mirror CDNs, which OX Security confirms persist indefinitely after takedown
Remediation for 24 Malicious npm Packages Abuse Registry Mirrors as Phishing
Immediate actions
- Block or alert on direct browser/user requests to raw .html files served from npm mirror CDNs (unpkg.com, npmmirror.com, the Tencent Cloud npm mirror, Yarn's registry mirror) outside normal package-manager/dependency-resolution traffic
- Add the known redirect/typosquat domains (login[.]microsofte[.]live, microcloud[.]homes) to web and DNS blocklists
- Report the identified packages and their file paths to npm, unpkg, npmmirror, and Tencent Cloud mirror maintainers to request cache purges
Workarounds
- Where dependency workflows do not require it, restrict outbound access to npm registry mirror CDNs (unpkg.com, npmmirror.com) at the network egress layer
Longer-term hardening
- Treat trusted CDN/mirror domains (unpkg.com, npmmirror.com, cdn mirrors of package registries) as potential phishing-hosting infrastructure in URL/web filtering policy, not solely as safe developer resources
- Monitor outbound traffic to free key-value/dead-drop-style APIs (e.g. keyval.org and similar pastebin/config-store services) that can be abused as redirect resolvers
- Run user-awareness training on ClickFix / fake-CAPTCHA social engineering (T1204.004) — legitimate verification pages never ask a user to open a terminal or Run dialog and paste a command
Weaknesses (CWE) in 24 Malicious npm Packages Abuse Registry Mirrors as Phishing
CWE-506, CWE-451
Timeline of 24 Malicious npm Packages Abuse Registry Mirrors as Phishing
- Security researcher inf0stache first identifies the npm package 'china_airlines' using a fake Cloudflare verification page that redirects visitors to the attacker-controlled domain microcloud[.]homes — the earliest known variant of this technique.
- Publication window begins for the cluster of 24 malicious npm packages later identified by OX Security (window: 2026-08-04 to 2026-08-24).
- GitHub Security Advisory GHSA-35pm-fj6m-m6v6 and OSV report MAL-2026-13785 are published for the npm package bgzxcuite2@1.0.0, classifying it as embedded malicious code (CWE-506).
- Publication window for the 24-package cluster closes; by this point redirect infrastructure has shifted from the hardcoded typosquat domain login[.]microsofte[.]live to the legitimate key-value API api.keyval.org used as a dead-drop resolver.
- The Hacker News and BleepingComputer publish independent coverage of the OX Security findings, contextualizing it alongside the related October 2025 'Beamglea' 175-package npm/unpkg mirror-abuse campaign documented by Socket.
- OX Security publishes research disclosing the full 24-package campaign, the mirror-abuse hosting technique, and its connection to the ClickFix (T1204.004) social-engineering pattern.
- npm removes a subset of the identified packages (e.g. bgzxcuite2, prezdentkxheiw, egair0810, mnteckets, airdzticket, egypt0811, passport811) from the registry; researchers confirm mirror copies on unpkg, npmmirror, and the Tencent Cloud npm mirror remain live and reachable after takedown, while several other packages in the cluster remain live on npm itself.
- Cyber Security News publishes coverage of the campaign, the article that triggered this threat record.
Sources cited for 24 Malicious npm Packages Abuse Registry Mirrors as Phishing
- 24 Malicious npm Packages
- ClickFix Phishing Pages Discovered in 24 npm Packages
- 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
- Hackers abuse npm mirrors to host phishing redirect pages
- MAL-2026-13785 — bgzxcuite2 malicious package report
- GHSA-35pm-fj6m-m6v6 — bgzxcuite2 embedded malicious code
- npm package registry entry — bgzxcuite2@1.0.0
More in supply chain
- Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin
- PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting
- Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected
- SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
- GemStuffer: AI Agent Swarm Floods RubyGems With 2,000+ Malicious Packages, Achieves RCE via RubyDoc.info Build System, Attempts API Key Theft
Detection coverage for TL-2026-2150
As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2150 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.