Hackers abuse npm mirrors to host phishing redirect pages

Attackers are exploiting npm and its mirror infrastructure to host malicious HTML pages designed to mimic Cloudflare CAPTCHA challenges. These pages serve as phishing redirectors, leading unsuspecting users to websites controlled by the attackers. This technique abuses the legitimate npm ecosystem to distribute phishing content, potentially increasing the likelihood of victim interaction due to the trusted source of the content. No specific software vulnerability is described; rather, this is an abuse of hosting infrastructure for phishing purposes.

Users accessing malicious content hosted on npm mirrors may be redirected to phishing websites, potentially leading to credential theft or other social engineering attacks. The threat leverages the reputation of npm to increase trust in the malicious pages. There is no indication of direct compromise of npm software or infrastructure, nor evidence of active exploitation beyond hosting phishing content.

No official patch or fix is applicable as this is an abuse of hosting infrastructure rather than a software vulnerability. Users and organizations should exercise caution when accessing content from npm mirrors and verify the authenticity of npm packages and their sources. Monitoring for suspicious or unexpected redirects in web traffic may help detect abuse. Vendors managing npm mirrors should investigate and remove malicious content promptly.