24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Cybersecurity researchers have uncovered a campaign utilizing 24 npm packages to host fake Cloudflare CAPTCHA pages. These packages serve as free phishing infrastructure, redirecting users to ClickFix-style fake CAPTCHA pages. The malware consists of a single HTML page within the npm package, which is harmless to download. However, the threat actor's intention is not to infect developers who install the package, but rather to leverage the npm packages for malicious purposes. The packages are being used to support phishing activities, taking advantage of the infrastructure provided by unpkg mirrors.