Fake Cloudflare CAPTCHA HTML served from unpkg.com npm mirror

Arnold Chan@slaz

•updated Sep 6, 2026•0•0•1

Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.