24 Malicious npm Packages Abuse Trusted Mirrors to Host ClickFix Phishing Pages

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Spread the love

Twenty-four malicious npm packages have been used to turn trusted package mirrors into staging points for ClickFix phishing pages.

The campaign does not infect a developer by installing a package. Instead, it exploits the confidence users place in familiar hosting domains to make a phishing page appear safer than it is.

The packages contain a single HTML file that imitates a Cloudflare verification screen. When a person opens that file through a mirrored package URL, the page can contact attacker-controlled infrastructure and redirect the visitor elsewhere.

This creates an indirect attack path, where the registry ecosystem becomes the delivery channel rather than the malware execution point.

Researchers at OX Security identified 24 distinct packages carrying the same malicious page, typically attracting 50 to 300 weekly downloads before removal. 

OX Security said in a report shared with Cyber Security News (CSN) that the activity could potentially deliver ClickFix malware through npm. The finding matters because a removed package may remain available through mirrors.

Fake security verification (Source - OX Security)
Fake security verification (Source – OX Security)

A visitor who receives a direct link may see the phishing page hosted under a domain associated with package delivery, not an obvious criminal site. This highlights how trusted web infrastructure can be repurposed for social engineering.

24 Malicious npm Packages Abuse Trusted Mirrors

npm packages are automatically copied by services including unpkg, Yarn, npmmirror and Tencent mirrors. Services expose package files directly rather than only the compressed archive.

That means a link to an HTML file can render a complete page in a browser, effectively giving attackers a front end on a recognized domain.

In this case, the malicious HTML presents a fake Cloudflare CAPTCHA and includes scrambled JavaScript. The code requests information from a remote service before deciding where to send the visitor.

The method resembles a separate campaign in which malicious npm packages hosted redirects through unpkg, showing that package mirrors are attractive infrastructure for credential-focused attacks.

The earlier version contacted a Microsoft lookalike domain, while later samples used a legitimate key-value service to retrieve encrypted data.

Domain was blacklisted after the first wave of the malware (Source - OX Security)
Domain was blacklisted after the first wave of the malware (Source – OX Security)

The remote logic directed users to the real ChatGPT site. Researchers warned that the destination could change to a ClickFix page or another phishing lure, without changing the mirrored package file.

That flexibility is the core concern. ClickFix attacks persuade a victim to copy and run a command, often under the guise of completing a verification check, instead of relying on a browser exploit.

Recent reporting on fake verification page infections shows how such prompts can lead from a familiar-looking challenge to malware and account fraud.

Detection needs a different lens

Security teams should not automatically block every package mirror, since these services support normal development work.

They should, however, treat mirror domains as possible phishing hosts when users are not downloading packages. Adding mirror URLs to phishing and URL-reputation checks can help identify abuse that conventional filters might overlook.

Defenders should also review proxy and DNS records for direct requests to .html files within mirrored packages. Such activity is more suspicious than a routine dependency download, particularly when it comes from employee endpoints without a development role.

The advice aligns with broader coverage of CAPTCHA and ClickFix tactics, which depend on getting users to perform the final harmful action themselves.

Fake login page (Source - OX Security)
Fake login page (Source – OX Security)

For developers, the practical lesson is to be cautious with direct mirror links shared in messages, tickets, adverts or search results. A trusted domain is not proof that every file it serves is safe.

Teams can reduce exposure by validating package names and publishers, limiting access to unneeded public mirrors, and teaching staff never to paste verification commands into a terminal or Run dialog.

The campaign also challenges the assumption that a harmless installation means a harmless package. Here, the package acts as storage for a phishing component, and mirrors may preserve that component after the registry entry disappears.

Similar developer-targeted schemes, including deceptive npm installation messages, reinforce the need to assess package behaviour, hosted files and delivery routes together.

Indicators of compromise (IoCs):-

Type Indicator Description
Domain login[.]microsofte[.]live Typosquatted Microsoft domain used by the earlier campaign version
Domain api[.]keyval[.]org Legitimate key-value service abused to retrieve encrypted redirect data
URL https://unpkg[.]com/[email protected]/index.html Direct mirror-hosted malicious HTML page
Encoded value PpihAtpV1i29jeS3Skk7XU74X2Zkd5wyzF2DOzY77k1Fz7GNvGafkxVGs+z6VOGy6E43n+JQgKSUsn+S5NjXlBmcq4= Encrypted value retrieved through the remote logic
Malicious npm package bgzxcuite2 Microsoft typosquat family, taken down
Malicious npm package prezdentkxheiw Microsoft typosquat family, taken down
Malicious npm package egair0810 Microsoft typosquat family, taken down
Malicious npm package mnteckets Microsoft typosquat family, taken down
Malicious npm package airdzticket Microsoft typosquat family, taken down
Malicious npm package egypt0811 Microsoft typosquat family, taken down
Malicious npm package passport811 Microsoft typosquat family, taken down
Malicious npm package vxhjkseuiaqkb Microsoft typosquat family
Malicious npm package ndmushdkeqe Microsoft typosquat family
Malicious npm package ndmxchdjxn2 Microsoft typosquat family
Malicious npm package ndmfguyhoxc3 Microsoft typosquat family
Malicious npm package mjsdqwocvn Microsoft typosquat family
Malicious npm package m2fcsfyjkuxb Microsoft typosquat family
Malicious npm package m3fdfocdoewn Microsoft typosquat family
Malicious npm package @worrisome/reutil keyval new-logic family
Malicious npm package testdgdbcsd Microsoft typosquat family
Malicious npm package tesgfvbncsdbcv Microsoft typosquat family
Malicious npm package mndsxcusiwlk1 keyval new-logic family
Malicious npm package mn2adskhweox keyval new-logic family
Malicious npm package mn3sadkoiewu keyval new-logic family
Malicious npm package mn4xcouzvhus keyval new-logic family
Malicious npm package mbxcnsuwgs1 keyval new-logic family
Malicious npm package skxcmwuncbg2 keyval new-logic family
Malicious npm package mobiwaefhxc3 keyval new-logic family

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post 24 Malicious npm Packages Abuse Trusted Mirrors to Host ClickFix Phishing Pages appeared first on Cyber Security News.