Turning Public Package CDNs into Phishing Infrastructure
A newly uncovered supply chain campaign has demonstrated how threat actors are repurposing npm package mirrors and public content delivery networks (CDNs) to host deceptive phishing pages. By publishing lightweight packages containing malicious HTML files to the npm registry, attackers exploit open CDN services like unpkg to serve convincing fake Cloudflare verification pages without maintaining dedicated hosting infrastructure.
Disclosed by security researchers, the campaign leveraged at least 24 distinct npm packages. While the packages themselves contain no traditional executable malware or malicious dependencies, their presence on the registry allows attackers to generate stable, legitimate-looking URLs through public npm mirrors. These mirrors automatically unpack and serve static package assets directly to web browsers, granting attackers trusted domains with valid SSL certificates.
Anatomy of the unpkg Fake CAPTCHA Redirection Flow
The attack mechanism relies on a deceptive technique known as ClickFix, combined with the domain reputation of popular JavaScript CDNs. Because services like unpkg.com resolve files directly from the npm registry path (such as unpkg.com/package-name/index.html), attackers receive instant, high-uptime web hosting on a domain trusted by corporate firewalls and email security filters.
When an unsuspecting victim lands on the hosted page, they encounter a pixel-perfect replica of a Cloudflare Turnstile or CAPTCHA verification challenge. The page informs the user that automated security checks failed and instructs them to complete verification manually.
Depending on the campaign configuration, the page either redirects visitors to external credential harvesting sites or prompts users to copy and execute a PowerShell snippet into their terminal to verify their browser. Because the initial landing URL originates from a reputable package CDN, automated reputation scanners frequently fail to flag the link in incoming email or messaging streams.
The Mechanics of ClickFix Lures on Developer CDNs
The ClickFix lure has emerged as one of the most effective social engineering patterns in modern cyber attacks. When users see a familiar CAPTCHA interface, cognitive friction drops. The fake verification screen instructs the user to press the Windows key + R, paste a base64-encoded command string, and hit Enter to prove they are human.
Hosting this script on unpkg gives attackers an extra layer of legitimacy. If a network perimeter scanner evaluates the URL, it observes a valid HTTPS certificate issued to Cloudflare, an unflagged root domain (unpkg.com), and standard web assets. Because the malicious package payload consists of plain HTML and JavaScript without obfuscated binary blobs, traditional package scanning pipelines pass it as benign repository content.
Why Abusing Registry CDNs Bypasses Traditional Defenses
This tactic exposes a recurring blind spot in web security architectures: the gap between package registry integrity and public mirror consumption.
Security scanners focused on open-source ecosystems naturally look for compromised maintainers, typosquatting, post-install script hooks, and obfuscated runtime payloads. A package containing a clean, non-malicious HTML landing page does not trigger software composition analysis (SCA) alerts because it poses no danger to developers installing it in an application.
However, once that package is indexed by public CDNs, it functions as unrestricted cloud storage. Threat actors effectively offload their hosting costs, domain acquisition requirements, and SSL certificate management onto the open-source community infrastructure.
Broader Ecosystem Risks of Unrestricted Asset Serving
The open-source package ecosystem has spent years hardening against code execution risks, implementing provenance attestations, two-factor authentication requirements for maintainers, and automated secret scanning. Yet the layer connecting registry storage to browser-accessible CDNs remains largely governed by permissive file resolution rules.
As developer infrastructure continues to be mirrored across global edge nodes for performance, any registry that permits arbitrary asset uploads inadvertently becomes an unmoderated static web hosting provider. Similar abuse patterns have been observed across other public code repositories and artifact hosts, where legitimate developer utility is repurposed as a free evasion tactic by criminal infrastructure operators.
Detection Engineering and Threat Hunting Patterns
Security teams monitoring endpoint telemetry and network proxies can implement specific detection rules to intercept this campaign style before malicious commands run.
Monitor endpoint process creation events where explorer.exe or browser processes spawn cmd.exe or powershell.exe with clipboard-reading arguments. Legitimate applications rarely ask users to manually paste command sequences into run dialogs from browser prompts.
Additionally, configure DNS query logging to track unusual spikes in subdomain resolutions to public npm mirrors from non-developer subnets, identifying infected or targeted endpoints navigating to unpkg paths hosting HTML content.
Mitigation and Hardening Guidance for SecOps Teams
Defending against CDN abuse requires adjustments to network egress filtering, corporate DNS policies, and email protection rules.
First, security operations teams should review corporate proxy logs for direct browser traffic to raw CDN endpoints like unpkg.com, jsdelivr.net, and cdnjs.cloudflare.com. While developer workstations legitimately pull JavaScript bundles during local builds, general office workers have little reason to navigate directly to HTML files hosted on package CDNs in their standard web browsers.
Second, web proxy gateways and Secure Access Service Edge (SASE) solutions should be configured to block direct navigation to HTML MIME types delivered from known public package CDNs unless explicitly whitelisted for development testing.
Third, registry maintainers and CDN operators are exploring tighter policy controls around rendering raw HTML files with permissive MIME types. Restricting CDN endpoints to serve non-executable text or forcing application/octet-stream headers on arbitrary HTML files significantly reduces the utility of public registries as phishing launchpads.