148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet
JFrog uncovered 148 npm packages masquerading as student proxy tools that silently conscripted visitors' browsers into a DDoS botnet — a supply-chain twist targeting end users rather than developers.
Summary written by editorial AI · Source link below
A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed denial-of-service botnet for roughly two weeks in May, according to new research from JFrog.
The packages did not go after the developers who might install them. The operators used the registry as free hosting for a booby-trapped proxy site and let the students who came to dodge
Editorial Analysis
This campaign shifts the supply-chain threat model: instead of compromising developer machines, attackers weaponise the downstream user base, broadening blast radius and complicating detection.
Review npm dependency policies and enforce package provenance checks (e.g., npm audit signatures) in CI/CD pipelines to block unsigned or suspicious packages.
Malicious open-source packages turned end-user browsers into attack infrastructure, underscoring the need for stricter software supply-chain governance.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.