Learn
active
Threat actors abuse npm mirrors to host Cloudflare CAPTCHA phishing pages
- Engineer — Learn: This highlights npm and its mirrors being misused as hosting infrastructure for phishing redirects — not a package-level supply-chain attack, but a reminder that npm CDN URLs can surface malicious HTML content. No patch or config change needed today; worth noting if internal tooling renders or fetches npm-hosted content for users.
- SOC/IR — Learn: A novel phishing delivery technique using trusted npm mirror domains as redirect hosts; without specific IOCs in this report, there is no immediate hunt to run, but analysts should track for follow-on reporting with domains or URLs to add to proxy/DNS blocklists.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.