Hackers Use npm Mirrors to Host Phishing Redirect Pages

Researchers have identified an npm mirror phishing technique that uses package registries and public mirrors to host malicious redirect pages.

Instead of infecting developers who download a package, attackers store harmful HTML files inside npm packages. Mirror services then copy those files and make them available from trusted developer-related domains.

This approach can make phishing pages appear more credible and may help attackers avoid security filters that block suspicious websites.

Attackers use npm packages as free web hosting

Security researcher inf0stache first spotted the technique in July. Later, OX Security found 24 npm packages that contained similar malicious HTML pages.

The packages do not install malware or steal data directly from a developer’s computer. Instead, attackers use the npm registry as storage for files that browsers can load through services such as UNPKG and npmmirror.

When a visitor opens one of those HTML files through a mirror, the browser displays it under the mirror’s legitimate domain.

Fake verification pages redirect visitors

The malicious pages imitate Cloudflare verification screens and include the genuine Cloudflare Turnstile CAPTCHA service.

However, the page runs hidden JavaScript regardless of whether the visitor completes the verification. That code then redirects the visitor to an attacker-selected destination.

Attackers can use this npm mirror phishing method to send victims to credential-stealing pages, malware downloads or other harmful websites.

Remote controls let attackers change destinations

Some newer packages use a legitimate key-value storage service to retrieve an encrypted redirect address.

The page decrypts the address in the visitor’s browser and redirects the person to that destination. This lets attackers change the final website without modifying or republishing the npm package.

Researchers saw some redirects point to legitimate websites during testing. However, attackers could change the destination at any time and send users to a phishing page instead.

Mirrors may retain removed packages

OX Security warns that npm mirrors may continue to serve package files after npm removes a package from the official registry.

That can extend the life of malicious pages and make takedown efforts more difficult.

Users should treat direct links to HTML files on npm mirror domains with caution. A trusted hosting domain does not guarantee that every page it serves is safe.