148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet
Summary: JFrog research found 148 npm packages posing as student web proxies that turned visitors' browsers into a DDoS botnet for roughly two weeks in May, using names like charlie-kirk and ilovefemboys and branded tutoring pages such as Riverbend Tutoring. The packages carried no install-time hooks; instead they loaded a remote script from a mutable GitHub main branch via jsDelivr and a WebSocket flood generator that opened up to 1,024 Wisp connections per browser, with an archived May 30 payload firing one-million-character POSTs at cdn.caan.edu, the domain of a nursing school in Matteson, Illinois.
What you should know: JFrog estimates each open proxy tab pushed about 2 MB per second, so a thousand tabs would send roughly 2 GB per second at the target, and the operators kept the ability to re-arm the attack with a single commit to that mutable branch - no package update required.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026