24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

The Hacker News 25 August 2026, 14:52 EEST Security Cloud

Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't do harm, the threat actor’s use of npm isn't to infect developers who install it, but to use the…

Read the full story on The Hacker News https://thehackernews.com/2026/08/24-npm-packages-abuse-unpkg-mirrors-to.html

Attacks like this land on ordinary sites far more often than on chosen targets. If you would rather your site never became the story, CrockyHost hosting ships with daily backups, automatic updates and a firewall we manage.

Keep reading

Hackers breached over 270 Zimbra servers in ongoing attacks BleepingComputer
Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows The Hacker News
E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands The Hacker News
Frontier AI: Vulnerability Management's Systemic Revolution The Hacker News