Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. [...]
Hackers abuse npm mirrors to host phishing redirect pages
Summary + source link. No paywalls, no tracking.