ClickFix Phishing Hidden in Malicious npm Packages

Threat actors distribute 24 malicious npm packages containing HTML pages that mimic Cloudflare Captcha verification interfaces. These pages are hosted on popular npm mirrors like unpkg, yarn, and npmmirror, leveraging their trusted domains to increase phishing credibility. Early versions redirected victims to a typosquatted Microsoft domain, while later versions dynamically retrieved redirection targets from legitimate key-value storage services. The campaign exploits npm registries as persistent, validated storage for phishing content, demonstrating infrastructure abuse. The packages themselves are harmless to download, but accessing the embedded HTML files through mirror URLs leads to phishing attacks such as ClickFix.

Users accessing the malicious HTML pages via npm mirrors may be exposed to phishing attacks that impersonate Cloudflare Captcha verification, potentially leading to credential theft or further malware delivery. The use of trusted mirror domains increases the likelihood of user trust and successful phishing. The campaign abuses supply chain infrastructure but does not compromise the npm packages themselves or the npm registry security.

No official patch or fix is applicable since the threat involves abuse of public npm mirrors hosting malicious content. Users and organizations should avoid accessing HTML files directly from npm mirror URLs unless the source is verified. Security teams should educate users about phishing risks involving trusted domains and monitor for suspicious npm packages or mirror URLs. Blocking access to known malicious mirror URLs or implementing web filtering can reduce exposure.