148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet

Researchers at JFrog discovered a campaign involving 148 npm packages that were disguised as student web proxies. These packages were used to turn visitors' browsers into a distributed denial-of-service botnet for about two weeks in May. The packages did not target developers who might install them, instead they were used to host a booby-trapped proxy site. The operators of the campaign relied on students visiting the site to bypass restrictions, unknowingly participating in the botnet. The campaign used the npm registry as free hosting for the proxy site. The botnet was active for a relatively short period of time, roughly two weeks.