As reported by The Hacker News, OX Security researchers have uncovered a cluster of 24 npm packages being used not to compromise developers, but to exploit npm's mirror ecosystem as free, trusted phishing infrastructure. This is a subtle but important distinction that changes how defenders should think about the threat surface.

Threat Alert: As reported by The Hacker News, OX Security researchers have uncovered a cluster of 24 npm packages being used not to compromise developers, but to exploit npm's mirror ecosystem as free, trusted phishing infrastructure.

Why This Campaign Is Different

Most npm-based attacks follow a predictable pattern: malicious code executes on install or import, compromising the developer's environment. This campaign breaks that mold entirely. The packages contain a single HTML file that is never executed during installation. The threat actor doesn't care if anyone ever runs npm install. They care that the package gets mirrored to unpkg.com, a CDN that serves npm package contents over a domain with strong reputation.

This is a reputation laundering technique. Security products, email filters, and browser reputation systems generally trust unpkg.com because it's a legitimate, widely-used developer tool. By embedding phishing pages inside npm packages and serving them through unpkg, the attacker inherits that trust. The URL unpkg.com/ndmxchdjxn2@1.0.0/index.html looks innocuous to most automated and human reviewers alike.

The attacker's goal isn't package consumption—it's infrastructure abuse. npm and its mirrors have become a free CDN for phishing operators, and current package security tooling isn't designed to catch this.

The Dead Drop Resolver Evolution

The campaign's pivot from a typosquat domain (login.microsofte.live) to KeyVal's public API as a dead drop resolver (DDR) demonstrates operational adaptability worth noting. When Google Safe Browsing blocklisted the initial domain, the attacker didn't just register a new one—they restructured the redirect logic to use a legitimate key-value store API. This means the malicious redirect URL can be changed dynamically without modifying the npm package at all.

Currently redirecting to the legitimate ChatGPT site, this configuration could be flipped to any phishing or malware delivery domain at any time. The npm packages are essentially dormant infrastructure waiting to be activated.

Who Is at Risk

The Dead Drop Resolver Evolution
End users who receive links pointing to unpkg.com domains in phishing emails, messages, or malicious ads—they see a trusted domain and a familiar Cloudflare CAPTCHA prompt
Organizations whose employees may be socially engineered into clicking these links, especially in contexts where unpkg.com is already allowlisted for development purposes
The npm ecosystem itself, as repeated abuse erodes trust in package mirrors and may force restrictive policy changes that impact legitimate developers

Broader Implications

This is the second documented wave of this technique. In October 2025, Socket detailed 175 npm packages using the same unpkg CDN abuse pattern. The recurrence signals that this is now an established playbook in the threat actor community. Any public package registry with a CDN mirror—PyPI, crates.io, NuGet, Packagist—is potentially vulnerable to the same abuse model.

The core problem is architectural: package registries and their mirrors were designed to serve content to developers, not to serve arbitrary HTML to end users in browsers. No current control effectively prevents someone from publishing a package whose primary purpose is to be served as a web page rather than consumed as code.

Shield53 Recommendations

For Security Teams

  • Restrict unpkg.com in browser policies: If unpkg is not needed for end-user browsing, block or warn on it in your web filtering solution. Developers who need it for build tooling should access it from development environments, not general-purpose browsers
  • Monitor for unpkg URLs in phishing simulations and threat hunting: Add unpkg.com package URL patterns to your phishing detection rules and email gateway filters, particularly URLs ending in /index.html or .html within package paths
  • Deploy ClickFix-aware browser protection: Ensure your endpoint or browser security tooling can detect fake CAPTCHA verification pages, as ClickFix-style social engineering continues to proliferate
  • Audit allowlists: If unpkg.com or similar CDN mirrors appear in your organization's URL allowlists, verify they are scoped appropriately and not broadly trusted across all user traffic

For Package Registry Operators

  • Implement heuristics to flag packages containing HTML files with no JavaScript entry points, especially when those HTML files include CAPTCHA-like or redirect logic
  • Consider rate-limiting or restricting direct browser access to package file contents on mirror CDNs, or adding interstitial warnings for non-standard usage patterns

For Developers

  • Use package security scanning tools like Socket or Snyk that analyze package behavior, not just known vulnerability signatures
  • Be cautious of packages with nonsensical or randomly generated names—this campaign's package names (e.g., ndmxchdjxn2, mn2adskhweox) follow an obvious pattern of keyboard-mash naming