GCVE-110-OSM-2026-11096

This campaign abuses npm's public registry as a free, trusted-domain hosting platform for phishing pages. When a package is published to npm, CDN mirror services including unpkg.com, npmmirror.com, and yarn automatically make the raw package contents publicly accessible via URLs on their own trusted domains (e.g., unpkg[.]com/<package>@1.0.0/index.html). The threat actor exploited this to distribute a ClickFix phishing page: a fake Cloudflare "verify you are human" interstitial that uses social engineering to trick the visitor, then redirects them to a Microsoft credential-phishing page at a typosquatted Microsoft domain. The victim is a web user who reaches one of these mirror URLs — not a developer installing a dependency. The npm package itself is the delivery container, not the execution environment: the HTML file is not a Node module and the package has no install-time hooks. The package contains a single file, `index.html`, declared as `main` in `package.json`. The payload is activated only when a browser loads the file via an npm CDN mirror URL. `index.html` renders a fake Cloudflare Turnstile "Just a moment..." challenge page. The inline JavaScript is obfuscated using obfuscator.io's string-array technique. After the Turnstile widget completes (or times out / errors), the script assembles a redirect URL from the obfuscated string array and calls `window.location.replace()`, forwarding all query parameters from the original URL to the destination. **Redirect targets:** - `microcloud[.]homes` — observed earlier in the campaign (~July 2026) - `login[.]microsofte[.]live` — typosquatted Microsoft login domain