Hackers abuse npm mirrors to host phishing redirect pages

Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs. These pages redirect visitors to attacker-controlled websites. The attack leverages trusted package registries to distribute phishing content, posing a risk to developers and users who encounter these fake CAPTCHA pages during their workflow.