JFrog researchers uncovered 148 malicious npm packages that disguised themselves as student web proxies and converted visitors' browsers into DDoS botnet nodes. The campaign ran for approximately two weeks in May.
The attackers exploited npm's free hosting to distribute a compromised proxy site. Rather than targeting developers directly during installation, the malware activated only when students visited the proxy website itself. Once loaded, the JavaScript payload transformed each visitor's browser into an unwilling botnet participant capable of launching distributed denial-of-service attacks.
This approach represents a shift in npm supply chain attacks. Traditional campaigns focus on compromising developer machines through malicious code in package dependencies. Here, the threat actors used npm as distribution infrastructure while offloading payload execution to end-user browsers through the proxy interface.
The 148 packages remained undetected long enough to accumulate significant traffic from students seeking IP masking tools. Each visitor became a temporary botnet node, though the attack duration limited overall impact before npm removed the packages.
The incident demonstrates how attackers weaponize legitimate use cases. Students actively seek proxy solutions to bypass network restrictions, making them ideal targets for social engineering through npm's ecosystem. The malware didn't require code execution privileges on developer systems. Visiting the hosted proxy site triggered the infection.
JFrog's disclosure underscores the registry's ongoing vulnerability to abuse despite trust systems and scanning mechanisms. Threat actors continue discovering gaps between detection capabilities and sophisticated evasion tactics.
Organizations relying on npm should audit proxy packages with particular scrutiny. Students and casual npm users remain attractive targets precisely because they may lack the security awareness of professional developers. The campaign's relatively low technical complexity combined with high browser-based botnet potential makes this attack vector likely to resurface.
Defenders should maintain updated npm audit tools, restrict proxy package installations to verified sources, and monitor for unusual proxy configurations in development environments.