# npm Mirrors Are Now Free Phishing Infrastructure — And That's a Systemic Problem
The package registry that millions of developers trust to ship code is being used to serve fake Cloudflare checkpoints. Not as malware buried in a dependency — as the redirect page itself.
Threat actors have been uploading bare HTML files to npm and its global mirror network, pages that do nothing except impersonate a Cloudflare CAPTCHA and silently funnel anyone who clicks through to attacker-controlled destinations. No malicious package. No supply chain compromise in the traditional sense. Just the npm CDN doing exactly what it was built to do: serving files fast, globally, and credibly.
## The Infrastructure Play
This campaign isn't particularly sophisticated at the code level. The HTML files are simple — a convincing Cloudflare CAPTCHA UI, a spinner, maybe a ticking progress bar to nudge the user along. The sophistication is in the choice of hosting.
npm's registry mirrors span Cloudflare's own edge network and regional mirrors operated by entities like Taobao (cnpmjs.org) and others. Files served from registry.npmjs.org or its mirrors arrive over HTTPS, from IP ranges associated with trusted infrastructure, with minimal latency anywhere in the world. For a phishing operator running a redirect campaign, that's a better setup than most legitimate hosting budgets can buy.
The delivery mechanism also sidesteps a lot of conventional filtering. Many organizations that block newly registered domains or low-reputation hosting providers won't bat an eye at traffic to npmjs.org. Security tools trained on "what does a phishing URL look like" aren't calibrated for package registry paths. The URL pattern registry.npmjs.org/-/v1/search reads like developer tooling noise in a proxy log — and that's the point.
## Who Gets Hurt When Developers Are the Attack Surface
The immediate targets here aren't developers opening a terminal. The uploaded HTML files are designed to be linked to — embedded in phishing emails, SMS lures, malvertising redirects — and the victims are end users who land on what looks like a routine Cloudflare bot verification checkpoint.
Cloudflare CAPTCHAs have become ambient Internet furniture. Most users have trained themselves to click through them without reading the URL bar. That learned compliance is the vulnerability being exploited, and it's entirely behavioral — no patch fixes it.
But there's a developer-adjacent risk worth naming. npm packages can embed URLs in README files, package descriptions, and homepage fields that get rendered in registries, CI dashboards, and IDE plugin displays. The same HTML hosting trick could be used to inject convincing-looking links into spaces developers actively trust: a package README that links to "documentation" hosted on the same registry infrastructure.
## Why Takedowns Are Slower Than They Look
npm does remove abusive packages when reported. The problem is the mirror latency.
When a malicious file is removed from the primary registry, regional mirrors — particularly those operated independently of npm's parent Sonatype — can continue serving cached copies for hours or days. An attacker who seeds a campaign with enough pre-distributed links gets meaningful dwell time even after the primary source is gone. Defenders monitoring for the npm.org domain will miss traffic that's actually hitting a mirror.
The mirroring ecosystem exists for legitimate reasons: resilience, performance, regional data sovereignty. But the operational reality is that a takedown on npm.org doesn't equal a takedown everywhere. Attackers with enough patience to map the mirror network can exploit that gap deliberately.
## HackWire Analysis
This campaign fits squarely into a trend that's been accelerating since 2022: the deliberate weaponization of developer infrastructure as phishing real estate. We've seen it with PyPI packages used to stage credential-stealing payloads, GitHub Pages serving malware distribution sites, Google Sites hosting fake login portals, and Azure Blob Storage fronting business email compromise lures.
The common thread isn't technical sophistication — it's trust arbitrage. Attackers are renting legitimacy from platforms with strong domain reputations and global CDN coverage. The economic calculation is obvious: it's cheaper to abuse a free tier on trusted infrastructure than to build convincing infrastructure yourself, and it's significantly harder for defenders to block.
What's notable about the npm mirror variant specifically is that it exposes a gap in how security teams model "developer tooling" traffic. Most threat intelligence is built around consumer-facing phishing infrastructure. Nobody optimized their blocklists for package registry abuse because, until recently, it wasn't a primary attack vector.
The Cloudflare CAPTCHA lure also deserves more scrutiny than it's getting. This is at minimum the third distinct campaign in 18 months to use fake Cloudflare verification as a redirect or credential harvesting mechanism. The technique works because CAPTCHAs have been normalized as a speed bump before "real" content — and because the Cloudflare brand carries enough ambient authority that most users don't question it.
Defenders should add npm registry domains and their known mirrors to their proxy alert watchlists, flag HTML content-type responses from package registry paths as anomalous, and consider whether their user training has kept pace with the CAPTCHA-lure playbook. This particular campaign may be low-sophistication, but the infrastructure abuse template it represents is being adopted by actors at every level of the threat landscape.
— HackWire Editorial
## Related Coverage