24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

- Twenty-four npm packages just got caught moonlighting as free phishing hosting — not to infect developers who `npm install`, but to serve fake Cloudflare CAPTCHA pages via unpkg mirrors. Clever? Sure, in the way smuggling contraband through a threadbare hull is clever until someone checks the seals. The real damage lands on end-users funneled to these ClickFix-style pages — they run the "verification" script and hand over their machine. Who gets hurt: regular people who trust a CAPTCHA prompt, and the credibility of package registries already stretched thin. What serious readers should do: treat unpkg and similar CDN-fronted package mirrors as untrusted surfaces, not convenience utilities. Audit dependency trees for packages you didn't explicitly approve. And if your CI pipeline pulls from public mirrors without integrity verification — stop kidding yourself. Unsealed cargo is still unsealed cargo, even when it looks like a dependency. Delivery signature applied.