Fake Student Proxies on npm Turned Browsers Into a DDoS Weapon

Key points

• JFrog researchers found 148 malicious npm packages that ran for roughly two weeks in May 2024.
• The packages posed as free web proxies aimed at students trying to bypass school internet filters.
• Instead of attacking developers, the operation turned visiting students' browsers into a distributed denial-of-service botnet.
• The attackers used npm, a public code registry run by GitHub, as free hosting for their trap site.
• JFrog reported the packages to npm, which has since removed them.

A cluster of 148 malicious packages sat on npm, the world's largest public library of open-source JavaScript code, for about two weeks in May. They pretended to be free web proxies, the kind of tool a student might search for to get around a school's blocked-sites list. Anyone who visited the proxy site got quietly drafted into a botnet, a network of hijacked devices used to flood a target with traffic until it falls over. The research comes from JFrog and was first written up by The Hacker News.

What makes this campaign unusual is the target. Most malicious npm packages go after software developers, since developers are the people who actually install packages. Here, developers were never the mark. The attackers used npm the way someone might use a free web host: as a cheap, reputable place to park a website. Our coverage of fake Paysafe and Skrill SDKs on npm from 8 July shows the more typical pattern, where the developer installing the package is the intended victim.

How did this actually work?

Each of the 148 packages contained a small proxy website. Students looking for a way around school filters found the sites, loaded them in a browser, and started using them to visit blocked pages.

While the proxy did its job, hidden JavaScript turned the student's browser into a foot soldier. Every open tab quietly fired requests at a target chosen by the attackers. Multiply that by thousands of bored teenagers on lunch break and you've got a working distributed denial-of-service attack, where junk traffic overwhelms a website and knocks it offline. Students had no idea it was happening. The proxy loaded what they wanted; the attack ran behind it.

Why use npm as a host?

It's free, it's fast, and it's trusted. Npm is designed to serve code to millions of developers worldwide, so its content delivery network is quick and rarely blocked. School filters that would flag a random proxy site tend to wave npm traffic through without a second glance.

That's the clever part. The attackers didn't need to compromise anything. They abused a legitimate free service in a way its operators hadn't anticipated.

Who is behind it?

JFrog hasn't linked the campaign to any named group, and there's no public attribution. This looks more like criminal or hobbyist DDoS-for-hire activity than nation-state work. The tradecraft is opportunistic, the payload is unsophisticated, and schoolchildren aren't a target profile that fits an espionage crew. Treat anything beyond that as speculative.

JFrog reported the packages to npm's security team, and they've been taken down.

Should you worry?

For parents and teachers, the practical point is straightforward. Free proxy sites, VPNs of unknown origin, and unblocker tools are a common vector for young people to pick up hidden malware or, as here, get conscripted into attacks on other people's infrastructure. A page can look harmless while a browser tab does something else entirely.

For security teams, the wider signal is that public code registries are being used as generic free hosting by criminals. Blocking or monitoring outbound traffic to raw npm content URLs from user browsers, as distinct from developer machines, is worth examining.