Hackers Weaponize npm Mirrors for Free Phishing Redirect Hosting

Hackers are weaponizing npm and its mirrors as free web hosting for malicious phishing campaigns. OX Security discovered 24 npm packages housing identical malicious HTML pages designed to impersonate Cloudflare verification screens. The technique doesn't infect developer machines, instead relying on platforms like UNPKG to render payloads directly from trusted domains. Recent iterations fetch encrypted values from a key-value platform, allowing attackers to change the redirect destination remotely without republishing the package. "Threat actors keep finding and using new and novel techniques not just to deliver malware, but to use legitimate infrastructure to store their payloads and data." — OX Security Turning open-source registries into bulletproof frontend hosting is a logical next step for attackers who're tired of burning their own domains.