Imagine a storage facility so reputable that banks put its address on official mail — then someone rents a unit, fills it with a fake ATM, and points victims straight at the "trusted" building. That's essentially what just happened to npm's mirror network, except the storage units are JavaScript packages and the fake ATM is a Cloudflare "verify you're human" page built to steal your credentials.

24 Packages, One Recycled Trick

Researchers at OX Security found 24 npm packages sharing identical malicious code. The twist: these packages weren't built to infect anyone who installs them. They were built to get automatically copied by mirror services like unpkg, Yarn, npmmirror, and Tencent's mirror — services that dutifully cache every package npm publishes, no questions asked.

Once mirrored, an HTML file buried inside each package renders as a fully convincing fake Cloudflare CAPTCHA page — served from a domain your browser, and probably your IT department, already trusts. Click through, and you land in a ClickFix-style phishing flow designed to harvest credentials.

The Redirect That Refused to Die

The first version pointed victims to a typosquatted Microsoft login page. Once Chrome's Safe Browsing blocklist caught up and torched that domain, the attackers simply pivoted the payload to KeyVal, a free public key-value store, letting them swap the final destination on the fly without touching the original package at all.

Here's the part that should bug you: nobody has to run npm install for this to work. Victims just click a link. And because mirrors keep serving cached content long after npm pulls the original package, "we removed it from the registry" doesn't mean "it's gone."

The padlock-and-domain-name heuristic we've spent two decades training people to trust is exactly what this attack is built to exploit.

If "it's hosted on a domain I trust" no longer counts as safe, it's worth auditing where else that assumption is quietly running your security — start with WTK's free developer's guide to defending against supply-chain attacks.

Source: The Hacker News