Plan
active
24 npm Packages Abuse unpkg CDN to Host ClickFix Phishing Pages
- Engineer — Learn: Novel abuse of unpkg CDN as free phishing infrastructure — developers who install the packages are not the target, but this technique shows how legitimate CDN reputation can carry malicious payloads. Worth factoring into proxy/WAF policy reviews for unpkg.com egress.
- SOC/IR — Plan: ClickFix-style fake CAPTCHA pages hosted on unpkg.com may bypass domain-reputation filters; build or tune proxy detections for unpkg.com redirects to non-package HTML content and correlate with clipboard-execution behaviors downstream.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.