148 npm packages posed as student proxies to turn browsers into a DDoS botnet

Researchers at JFrog found 148 npm packages that abused the registry not to attack developers but as free hosting for a booby-trapped web proxy aimed at students trying to bypass school filters. Anyone who opened one of the proxy sites had their browser quietly conscripted into a distributed denial-of-service botnet, flooding target servers with HTTP and WebSocket traffic, alongside injected ads and tracking. Crucially, the packages contained no install-time scripts and were never meant to be added to a project, so dependency scanners and install sandboxes, which watch what runs on install, would not catch them. The operators can re-arm the dormant attack code with a single commit.

Check

Consider that npm and similar registries can host malicious web content, not just installable code; watch for browsers reaching proxy or tutoring-themed sites backed by package registries, and block known campaign domains.

Affected

Anyone, especially students, who visits one of these registry-hosted proxy sites; their browser is silently used to launch denial-of-service attacks, while organizations may see the resulting traffic from their networks.

Fix

Block the campaign's known package and domain indicators, educate users that free web proxies can weaponize their browsers, and treat public package registries as potential malware-hosting infrastructure, not just a dependency source.