← Back to Feed
Hackers abuse npm mirrors to host phishing redirect pages
August 25, 2026 · BleepingComputer · Severity: MEDIUM
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites.
Key Takeaways
- Threat actors abuse npm mirrors to host phishing pages mimicking Cloudflare CAPTCHAs for redirects.
- This tactic leverages legitimate package registry infrastructure to deceive users into attacker-controlled websites.
- The attack undermines trust in npm registries, posing supply chain risks to developers and organizations.