ClickFix Phishing Hidden in Malicious npm Packages

Reported 26 Aug 2026 by otx · Severity: medium

OX Security identified a campaign distributing fake Cloudflare Captcha pages through 24 malicious npm packages. The threat actors exploit npm mirrors like unpkg, yarn, and npmmirror as free hosting infrastructure for phishing content. Each package contains an HTML page that displ