24 npm Packages Host Fake CAPTCHA Phishing Pages

OX Security found 24 npm packages hosting fake Cloudflare CAPTCHA pages that redirect visitors to attacker-controlled sites via mirrors like UNPKG. The HTML embeds legitimate Turnstile and uses api.keyval.org as a dead drop resolver, currently redirecting to ChatGPT but changeable to ClickFix or phishing pages.