Threat actors are leveraging the npm package registry and its mirroring services to host malicious HTML pages, effectively turning these platforms into free web hosting for phishing redirects. This technique, distinct from typical supply-chain attacks that infect developer systems, uses npm as a validated storage mechanism for attacker-controlled content.
The issue was initially identified in July by a security researcher known as inf0stache, who discovered a package named 'china_airlines' that incorporated a fake Cloudflare verification page. This page was designed to redirect users to a malicious domain. Subsequently, security firm OX Security identified 24 additional npm packages containing similar malicious HTML pages hosted across npm and its mirrors.
When these packages are mirrored by services like UNPKG and npmmirror, individual files within them become directly accessible via a browser. For instance, an HTML file can be rendered from a URL such as `https://unpkg[.]com/ndmxchdjxn2@1.0.0/index[.]html`. This allows the malicious HTML to execute from a legitimate domain, potentially bypassing security measures that might block attacker-controlled infrastructure.
The malicious HTML pages are designed to impersonate Cloudflare security verification screens, often embedding the legitimate Cloudflare Turnstile CAPTCHA service. Regardless of the CAPTCHA outcome, the pages execute heavily obfuscated JavaScript to redirect the visitor.
Early versions of these redirects, observed in July, pointed to `microcloud[.]homes`. By August, some redirects were observed leading to `login[.]microsofte[.]live`. In some cases, these initial redirects ultimately resolved to the legitimate Microsoft Outlook mail login site at `https://outlook.office.com/mail`.
Later iterations of the attack adopted a more dynamic redirection method. This newer code retrieves an encrypted value from `api.keyval.org`, a legitimate platform for storing key-value pairs. The encrypted value is then decrypted in the user's browser, and the visitor is redirected to the resulting URL. This mechanism allows attackers to alter the redirect destination remotely without needing to modify or republish the npm package. At the time of OX Security's research, this method was redirecting visitors to the legitimate ChatGPT website.
While the current observed redirects have sometimes led to legitimate sites, the flexibility of this technique means attackers could easily change the destination to phishing pages, malware downloads, or other malicious content. OX Security also noted that npm packages, once published, may persist on mirroring services even after being removed from the official npm registry.
Security researchers advise treating direct HTML requests to npm mirror domains as potentially suspicious. This incident highlights a growing trend of threat actors exploiting legitimate infrastructure for payload storage and data delivery, rather than solely for direct malware distribution.
