npm ClickFix Campaign: 24 Packages Abusing unpkg CDN to Host Fake Cloudflare CAPTCHA Pages — Detection and Response Guide

Threat actors have weaponized the npm ecosystem — not by poisoning developer build pipelines, but by using it as free, trusted social-engineering infrastructure. Researchers have disclosed a campaign involving a cluster of 24 malicious npm packages whose entire payload is a single HTML page. On its own, downloading one of these packages harms nothing. The danger lies in what happens next: when the package is served through the unpkg CDN mirror, the HTML page renders as a fake Cloudflare CAPTCHA verification page — the hallmark lure of the ClickFix social-engineering technique.

This is a meaningful shift in attacker tradecraft. Instead of burning disposable domains that reputation engines flag within hours, the actor piggybacks on unpkg.com — a high-reputation, widely-allowlisted CDN that most corporate proxies and email security gateways treat as trusted. The result: phishing links that sail through URL filtering, land in front of end users, and walk them through the classic ClickFix playbook — "verify you are human" by pressing Win+R and pasting a clipboard-injected command that executes a malicious PowerShell or mshta payload.

The targets here are not developers. They are end users in your organization who receive a link — via email, malvertising, SEO poisoning, or a compromised site — that resolves to a legitimate-looking Cloudflare check hosted on unpkg infrastructure. If that user completes the "verification," you are one paste away from a stealer, loader, or ransomware precursor executing in user context.

Defenders need to act on three fronts immediately: hunt for ClickFix-style execution telemetry, harden endpoints against Run-dialog and clipboard-paste execution, and re-evaluate whether unpkg.com deserves blanket trust in your egress filtering policy.

Technical Analysis

Attack Chain

The campaign breaks down into four observable stages:

1. Infrastructure staging. The actor publishes npm packages containing nothing more than a single malicious HTML file. Because npm's security scanning focuses on install-time behavior (pre/post-install scripts, dependency confusion, obfuscated JavaScript in .js files), a bare HTML asset with no executable install logic passes review. The package sits dormant on the registry.

2. Trusted delivery via unpkg. The unpkg CDN automatically mirrors every file in every published npm package at a predictable URL pattern: https://unpkg.com/<package-name>@<version>/<file>. The actor constructs phishing URLs pointing at the HTML page inside their throwaway package. Because the link resolves to unpkg.com — a domain with excellent reputation operated as a core piece of JavaScript ecosystem infrastructure — it bypasses most URL categorization, safe-links rewriting, and email gateway inspection.

3. Fake CAPTCHA lure (ClickFix). The HTML page impersonates a Cloudflare Turnstile / "Verify you are human" challenge. Instead of a checkbox, the user is instructed to press Win+R (opening the Windows Run dialog), then Ctrl+V and Enter. Unbeknownst to the user, the page has used JavaScript (navigator.clipboard.writeText) to silently place a malicious command on their clipboard. Pasting executes it.

4. Payload execution. The pasted command typically invokes mshta.exe against a remote URL or a powershell.exe -w hidden -enc <base64> one-liner that downloads and runs a second-stage payload — historically in ClickFix campaigns this has been infostealers (Lumma, Vidar, StealC class), RATs, or ransomware loaders.

Why This Technique Is Effective

• No exploit required. There is no vulnerability being exploited — the "vulnerability" is user trust plus operating-system features (Run dialog, clipboard API) working exactly as designed. Patching does not help; detection and hardening do.
• Reputation laundering. Hosting on unpkg.com inherits the CDN's trust. Blocking the domain outright breaks legitimate developer workflows, so most organizations cannot simply blacklist it.
• Clipboard injection is invisible to most controls. Email gateways scan the link, not what the destination page writes to the clipboard after the user clicks.
• The malicious packages are inert on install. Developer-side npm auditing tools (npm audit, Socket, Snyk) see no malicious code execution in the package because there is none — the HTML only becomes a weapon when rendered in a browser via the CDN URL.

Affected Scope

• Delivery infrastructure: unpkg.com mirrors of 24 identified npm packages (the packages themselves contain only an HTML file — removing them from npm does not retroactively revoke cached CDN copies immediately, and re-publication under new names is trivial).
• Victim platform: Primarily Windows endpoints — ClickFix lures rely on the Windows Run dialog (Win+R), mshta.exe, and powershell.exe.
• Victim population: General end users reached via phishing email, malvertising, SEO poisoning, or injected links — not developers installing packages.

Exploitation Status

This campaign is actively deployed in the wild — the 24 packages were observed live on the npm registry and reachable via unpkg. No CVE applies; this is technique-based abuse of legitimate infrastructure (MITRE ATT&CK T1204.004 User Execution: Malicious Copy and Paste, with T1059.001 PowerShell and T1218.005 Mshta in the execution stage). There is no vendor patch; defense is entirely behavioral detection, policy, and user hardening.

Detection & Response

The highest-fidelity detection point for ClickFix is not the phishing page — it is the moment the pasted command executes. A browser process spawning mshta.exe or powershell.exe as a child, or a Run-dialog-launched (explorer.exe-parented) script interpreter reaching for the network, is the signature. The following detections are tuned to fire on those behaviors with minimal noise.

---
title: ClickFix Execution - Browser Spawning Script Interpreter
description: Detects mshta, powershell, wscript, cscript, or cmd spawned directly by a web browser, consistent with ClickFix fake CAPTCHA clipboard-paste execution or browser-delivered payload staging. While classic ClickFix runs via the Run dialog (explorer parent), pasted commands and copy-paste console execution frequently surface with the browser in the ancestry chain.
references:
  - https://attack.mitre.org/techniques/T1204/004/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/08/24
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate enterprise browser extensions or internal tooling invoking script engines
level: high
---
title: ClickFix Run Dialog Execution - Suspicious Command via Explorer
description: Detects mshta or encoded/hidden-window PowerShell launched by explorer.exe with network-fetch or obfuscation indicators, consistent with a user pasting a malicious command into the Windows Run dialog (Win+R) after a fake Cloudflare CAPTCHA ClickFix lure.
references:
  - https://attack.mitre.org/techniques/T1204/004/
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/08/24
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_img:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  selection_cli:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-enc'
      - '-e '
      - 'hidden'
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
  condition: selection_parent and selection_img and selection_cli
falsepositives:
  - Administrators intentionally running one-liners from the Run dialog (uncommon)
level: high
---
title: Egress to unpkg CDN Serving HTML Content
description: Detects network connections from browser processes to unpkg.com. unpkg is a legitimate npm CDN, but this campaign abuses it to host fake CAPTCHA phishing pages. Deploy as a hunting/analytic rule and correlate with proxy logs and email gateway click data rather than alerting standalone in environments with heavy developer usage.
references:
  - https://attack.mitre.org/techniques/T1566/002/
author: Security Arsenal
date: 2026/08/24
status: experimental
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|endswith: 'unpkg.com'
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  condition: selection
falsepositives:
  - Developers browsing package contents; documentation sites hotlinking npm assets
level: low

// Hunt: ClickFix-style execution - script interpreters with network URLs
// spawned by browsers or explorer.exe (Run dialog paste execution)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "cmd.exe")
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "explorer.exe")
| where ProcessCommandLine has_any ("http://", "https://", "-enc", "FromBase64String", "DownloadString", "Invoke-Expression", "IEX", "hidden")
// Exclude common admin/software-update noise
| where ProcessCommandLine !has_any ("chocolatey", "winget", "microsoft.com/fwlink")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, ReportId
| order by TimeGenerated desc

// Correlate: devices that fetched content from unpkg.com via browser within 10 min of script execution
let UnpkgFetch = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has "unpkg.com"
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
| project DeviceName, FetchTime = TimeGenerated, RemoteUrl;
let ScriptExec = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("http", "-enc", "DownloadString", "FromBase64String")
| project DeviceName, ExecTime = TimeGenerated, FileName, ProcessCommandLine;
ScriptExec
| join kind=inner UnpkgFetch on DeviceName
| where ExecTime between (FetchTime .. FetchTime + 10m)
| project DeviceName, FetchTime, RemoteUrl, ExecTime, FileName, ProcessCommandLine

-- Velociraptor hunt: ClickFix post-execution triage
-- Identify suspicious script interpreters spawned from browsers or explorer,
-- plus prefetch evidence of mshta/powershell launched interactively.

-- Stage 1: Live process check for suspicious parent/child pairs
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)mshta|powershell|pwsh|wscript|cscript'
   AND CommandLine =~ '(?i)https?://|-enc|FromBase64String|DownloadString|Invoke-Expression')

-- Stage 2 (run separately): Netstat for established connections from script engines
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)mshta|powershell|pwsh'
  AND Status = 'ESTABLISHED'
  AND RemoteAddress !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

# ClickFix Hardening & Audit Script (run elevated on Windows endpoints or via GPO/Intune)

# 1) Audit current state: check if mshta is present and note for AppLocker/WDAC policy
$mshtaPath = "$env:SystemRoot\System32\mshta.exe"
if (Test-Path $mshtaPath) {
    Write-Host "[INFO] mshta.exe present at $mshtaPath - recommend blocking via AppLocker/WDAC if not business-required"
}

# 2) Enable PowerShell Script Block Logging (critical for catching -enc and IEX payloads)
$sbPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $sbPath)) { New-Item -Path $sbPath -Force | Out-Null }
Set-ItemProperty -Path $sbPath -Name "EnableScriptBlockLogging" -Value 1 -Type DWord

# 3) Enable PowerShell Module Logging
$modPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
if (-not (Test-Path $modPath)) { New-Item -Path $modPath -Force | Out-Null }
Set-ItemProperty -Path $modPath -Name "EnableModuleLogging" -Value 1 -Type DWord

# 4) Include command line in process creation events (Event 4688) - required for the Sigma rules above
$auditPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit"
if (-not (Test-Path $auditPath)) { New-Item -Path $auditPath -Force | Out-Null }
Set-ItemProperty -Path $auditPath -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1 -Type DWord

# 5) Audit process creation policy
auditpol /set /subcategory:"Process Creation" /success:enable /failure:disable

# 6) Optional but strongly recommended: disable the Run dialog for standard users via GPO-equivalent
# (Removes Win+R vector entirely - evaluate business impact first)
# $runPath = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer"
# if (-not (Test-Path $runPath)) { New-Item -Path $runPath -Force | Out-Null }
# Set-ItemProperty -Path $runPath -Name "NoRun" -Value 1 -Type DWord

# 7) Hunt: search local PowerShell history for ClickFix indicators (paste-executed commands)
$histPath = "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"
if (Test-Path $histPath) {
    Select-String -Path $histPath -Pattern 'https?://','-enc','FromBase64String','DownloadString','mshta' |
        ForEach-Object { Write-Host "[HIT] $($_.Line)" }
}

Write-Host "[DONE] Hardening and audit checks complete. Review AppLocker/WDAC policy for mshta.exe."

Remediation

There is no patch for this campaign — it abuses legitimate infrastructure and intended OS functionality. Remediation is architectural and behavioral:

1. Report and demand takedown. Report the malicious packages to npm's security team (npm maintains an abuse reporting process at npmjs.com and responds to registry abuse reports). Also report the unpkg-hosted URLs to the unpkg maintainers and to Cloudflare (the impersonated brand) via their phishing/abuse channels. Understand that takedown is whack-a-mole — the actor can republish under new package names in minutes — so takedown is a complement to, not a substitute for, endpoint controls.

2. Re-evaluate unpkg.com trust. Do not blanket-block unpkg.com if developers depend on it, but remove it from any "trusted CDN" allowlist that bypasses content inspection. Force it through TLS inspection and detonate fetched HTML in your secure web gateway. At minimum, alert on non-developer endpoints browsing to unpkg.com.

3. Block or constrain mshta.exe. Deploy AppLocker or WDAC rules denying mshta.exe execution for standard users. There is vanishingly little legitimate business use for mshta in 2026, and it is the single most abused ClickFix execution vehicle.

4. Attack Surface Reduction rules. Enable Microsoft Defender ASR rules for "Block execution of potentially obfuscated scripts" and "Block Office/child-process abuse" equivalents. Consider blocking child process creation from browser processes in high-security user groups.

5. Disable the Run dialog for standard users where feasible. The NoRun policy removes the Win+R vector that every fake-CAPTCHA ClickFix page instructs users to use. Pilot with a test OU first — legitimate IT workflows occasionally depend on it.

6. User awareness with specificity. Generic "don't click phishing links" training does not stop ClickFix. Train users on one concrete rule: no legitimate CAPTCHA or verification page will ever ask you to press Win+R, open a terminal, or paste a command. Cloudflare Turnstile is a checkbox — anything beyond that is an attack. Update phishing simulations to include ClickFix-style lures.

7. Clipboard API restrictions. Where browser policy permits, restrict clipboard-write access for untrusted sites (Chrome/Edge enterprise policies can gate the Clipboard API behind user gesture + permission). This blunts the silent clipboard-injection step.

8. Email and web gateway tuning. Add detection logic for emails containing unpkg.com links where the sender is external and the recipient is not in a developer role. ClickFix campaigns rely on volume; cutting delivery at the gateway is the cheapest control.

9. Post-incident actions. If a host executed a pasted command: isolate it, collect PowerShell Script Block logs and ConsoleHost_history.txt, acquire memory if a stealer is suspected (credential theft is the near-certain objective), force enterprise-wide credential resets for any user who was logged in, and review egress logs for the 72 hours surrounding execution for C2 or exfiltration.

Conclusion

This campaign is a reminder that supply-chain trust extends beyond the packages your developers install — it includes every CDN and mirror that inherits the ecosystem's reputation. The attackers here never needed to compromise a single developer; they rented trust for free and aimed it at your least technical users. The defensive answer is layered: behavioral detection on script-interpreter execution, policy controls that remove the Run-dialog and mshta vectors, and user training specific enough to name the trick. Organizations that treat "user execution" as an undetectable given will keep losing to a fake checkbox.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub