npm ClickFix: 24 Packages Weaponize Mirrors

Twenty-four npm packages published between August 4 and August 24, 2026 do not install malware when you run npm install. Instead, they turn trusted package mirrors into free phishing hosting. CVE: N/