Criminals Turn npm Into Free Hosting for Fake Cloudflare Login Traps

Key points

• Researchers documented 24 packages on npm, the world's largest registry of open-source JavaScript code, being used to host fake Cloudflare CAPTCHA pages.
• Each package contains a single HTML file, harmless to install, but served publicly through unpkg, a free mirror that turns any npm package into a live web page.
• The pages copy the ClickFix trick: they tell the visitor to paste a command into their computer to "prove they are human", which actually runs malware.
• Developers who install the packages are not the target; ordinary web users who land on the pages via phishing links are.
• The abuse points to a gap in how public package mirrors police the content they serve to browsers.

Security researchers have flagged a cluster of 24 packages on npm, the registry most JavaScript developers pull code from, that are not really software at all. Each one is a single web page. The packages sit on npm so that attackers can serve those pages, free of charge, through a public mirror.

The pages imitate Cloudflare's familiar "checking your browser" screen. It is the same screen millions of people see every day before a site loads. Here, though, the screen is a lure.

The campaign was first reported by The Hacker News, drawing on work by supply-chain security researchers who have been tracking the cluster.

What are the packages actually doing?

Nothing, if you install them. The danger is what they show in a browser. Each package contains one HTML file. When that file is loaded through unpkg.com, a free service that turns any npm package into a live URL, it renders a fake Cloudflare check page.

That page uses a technique called ClickFix. The visitor is told there is a small problem verifying their browser and asked to press Windows key plus R, paste a line of text, and hit Enter. Pressing those keys opens the Run box in Windows. The pasted line is a command that quietly downloads and runs malware, which is software designed to steal data or take over the machine.

The victim thinks they are solving a CAPTCHA. They are actually installing an infection by hand.

Why host phishing pages on npm?

Because it is free, fast, and the domain looks clean. Attackers usually have to buy web hosting and a domain, then keep them alive while security firms try to shut them down. Publishing a package to npm and pointing victims at the unpkg mirror gives them a page served from a well-known address, with a valid TLS certificate, at no cost.

Takedowns are slower too. The package has to be reviewed, removed from npm, and then flushed from the mirror. In the meantime, the phishing link in an email or a text message keeps working.

Who is at risk?

Ordinary web users, not developers. Installing one of these packages does not run any code on a developer's machine. The payload only matters when the HTML file is loaded in a browser through a link the attacker sends.

If you receive a message with a link that leads to a Cloudflare-looking check page and it asks you to press Windows+R and paste anything, close the tab. A real CAPTCHA never asks you to run a command on your computer. Ever.

Common questions

Is npm itself compromised?

No. The registry is working as designed. Attackers are abusing the fact that anyone can publish a package, and that a separate free service (unpkg) will then serve any file inside it as a live web page.

What should I do if I already followed the instructions on such a page?

Disconnect the affected computer from the internet, run a full scan with a reputable security tool, and change passwords for important accounts from a different device. If it is a work machine, tell your IT team straight away.