As cited
Copy frozen at (site build).
Hackers abuse npm mirrors to host phishing redirect pages
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Hackers abuse npm mirrors to host phishing redirect pages
Threat actors are leveraging npm repositories and mirrors to host malicious HTML pages that spoof Cloudflare CAPTCHAs, tricking users into visiting attacker-controlled sites. The technique exploits the trust and accessibility of public package repositories to distribute phishing infrastructure at scale.
Why it matters: Developers and organizations using npm are at risk of encountering compromised packages or mirrors; practitioners should monitor for suspicious packages and validate CAPTCHA authenticity before credential entry.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Hackers abuse npm mirrors to host phishing redirect pages
Threat actors are leveraging npm repositories and mirrors to host malicious HTML pages that spoof Cloudflare CAPTCHAs, tricking users into visiting attacker-controlled sites. The technique exploits the trust and accessibility of public package repositories to distribute phishing infrastructure at scale.
Why it matters: Developers and organizations using npm are at risk of encountering compromised packages or mirrors; practitioners should monitor for suspicious packages and validate CAPTCHA authenticity before credential entry.
- Source published
- First seen by Cybersecurity Tracker