Hackers abuse npm mirrors for phishing redirects

Threat actors abuse npm and mirrors like UNPKG and npmmirror to host malicious HTML pages impersonating Cloudflare CAPTCHAs, redirecting visitors to attacker-controlled sites. OX Security found 24 such packages. The pages embed Cloudflare's legitimate Turnstile service and execute obfuscated JavaScript to redirect regardless of verification outcome.