New npm Malware Hosts ClickFix Phishing Pages via Trusted Mirrors

Key Takeaways

• Twenty-four malicious npm packages have been identified, not for direct malware installation, but as hosts for ClickFix phishing pages.
• The attack leverages trusted npm package mirrors (e.g., unpkg, Yarn) to present phishing content under seemingly legitimate domains.
• The packages contain a single HTML file mimicking a Cloudflare verification screen, which then redirects users to attacker-controlled infrastructure.
• This campaign highlights an indirect attack vector, where the software registry ecosystem serves as a delivery mechanism for social engineering rather than an execution point for traditional malware.

A new phishing campaign has been uncovered, exploiting the npm ecosystem by transforming trusted package mirrors into staging grounds for ClickFix phishing pages. This sophisticated approach bypasses direct package infection, instead leveraging the inherent trust users place in established hosting domains to lend credibility to malicious content.

Exploiting Trusted Infrastructure for Phishing

The core of this campaign lies in its indirect attack methodology. Rather than attempting to infect a developer’s system through a malicious package installation, the attackers embed a single, deceptive HTML file within npm packages. When this file is accessed via a mirrored package URL, it renders a convincing phishing page, typically designed to mimic a Cloudflare security verification screen. This page then communicates with attacker-controlled infrastructure, enabling redirection to various malicious destinations.

This strategy effectively repurposes the registry ecosystem as a delivery channel for social engineering. According to a report by OX Security, who identified 24 distinct packages involved in this activity, the malicious packages typically garnered between 50 and 300 weekly downloads before their removal. The researchers emphasized that this activity could potentially facilitate the delivery of ClickFix malware through npm. A critical aspect of this threat is that even after a malicious package is removed from the primary npm registry, its content may persist and remain accessible through various package mirrors, extending its potential reach.

The efficacy of this attack hinges on user perception. When a target receives a direct link to such a phishing page, it appears to be hosted on a domain associated with legitimate package delivery services, not an obvious malicious site. This subtly undermines typical security awareness, as users are less likely to flag a URL from a recognized infrastructure as suspicious, highlighting a significant blind spot in conventional phishing detection mechanisms.

How Malicious npm Packages Abuse Trusted Mirrors

npm packages are automatically replicated by numerous services, including unpkg, Yarn, npmmirror, and Tencent mirrors. These services often expose package files directly, meaning that a link pointing to an HTML file within a mirrored package can be rendered as a complete webpage in a browser. This functionality inadvertently provides attackers with a readily available front-end hosted on a trusted domain.

In the observed attacks, the malicious HTML presented a fake Cloudflare CAPTCHA challenge. This page contained obfuscated JavaScript code designed to query a remote service. This remote logic dictated the user’s ultimate redirection. This method mirrors other campaigns where malicious npm packages were used to host redirects via services like unpkg, underscoring the appeal of package mirrors as infrastructure for credential-harvesting attacks.

Earlier iterations of this campaign directed users to a typosquatted Microsoft-like domain, while more recent samples leveraged a legitimate key-value service to retrieve encrypted redirection data. Initially, the remote logic redirected users to the authentic ChatGPT website. However, researchers warn that this destination is highly flexible and could be dynamically altered to lead to a ClickFix page or another phishing lure without requiring any changes to the mirrored package file itself. This adaptability is a primary concern, as ClickFix attacks are designed to trick victims into manually executing commands, often under the guise of completing a verification step, rather than relying on browser-based exploits. Recent reports on fake verification page infections demonstrate how these prompts can lead users from a seemingly routine challenge to severe consequences like malware infection and account compromise.

What You Should Do

• Enhance Phishing and URL Reputation Checks: Implement rigorous checks for mirror domains in your phishing and URL-reputation scanning tools. Treat mirror URLs as potential phishing hosts, especially when users are not actively downloading packages.
• Monitor Proxy and DNS Records: Scrutinize proxy and DNS logs for direct requests to .html files within mirrored packages. Such activity is highly suspicious, particularly if it originates from employee endpoints not typically involved in development.
• Educate Users on Direct Links: Advise developers and all staff to exercise extreme caution with direct mirror links shared via messaging platforms, support tickets, advertisements, or search results. Emphasize that a trusted domain does not guarantee the safety of every file it hosts.
• Validate Package Details: Encourage developers to always validate package names and publishers before use. Limit access to unnecessary public mirrors within your development environments.
• Never Execute Unverified Commands: Instill a strict policy that prohibits staff from pasting verification commands or any unfamiliar code into a terminal or Run dialog, especially when prompted by external links or unexpected messages.
• Assess Package Behavior Holistically: Move beyond simply checking for installation safety. Evaluate the overall behavior of packages, the files they host, and their delivery routes, as packages can serve as storage for malicious components that exploit mirrors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.