JFrog research reveals that in May, 148 npm packages posing as student web proxies transformed visitors' browsers into a distributed denial‑of‑service botnet for about two weeks. The attackers leveraged the npm registry as free hosting for a malicious proxy site.

मुख्य बिंदु (Key Takeaways)

  • 148 npm packages pretended to be student proxies and created a DDoS botnet
  • Attackers used the npm registry as free hosting for a malicious proxy
  • Developers and end‑users must adopt stronger supply‑chain security practices

JFrog’s latest report uncovers a sophisticated supply‑chain attack that unfolded in May 2024, where 148 npm (Node Package Manager) packages were published as “student web proxies.” While the packages did not target developers directly, every browser that accessed the embedded proxy was silently recruited into a distributed denial‑of‑service (DDoS) botnet.

Technical Mechanics

npm is the de‑facto repository for JavaScript libraries, hosting millions of packages that developers depend on daily. In this campaign, threat actors uploaded seemingly innocuous proxy packages that contained a hidden JavaScript payload. Once a user’s browser loaded the proxy script, it established a connection to a command‑and‑control (C2) server. The C2 then instructed the browser to flood target URLs with HTTP requests, effectively turning each victim’s machine into a DDoS source.

Comparison with Past Supply‑Chain Attacks

This incident joins a growing list of npm‑related supply‑chain compromises, such as the 2021 event‑stream malware injection and the 2022 ua‑parser‑js DDoS abuse. What sets this attack apart is the use of “student proxy” terminology, a niche that attracted many university students and freelancers seeking free web‑browsing tools, thereby widening the attack surface.

Impact and Immediate Response

According to JFrog, the botnet remained active for roughly two weeks, causing intermittent downtime for several small‑to‑mid‑size online services. npm responded by removing the malicious packages from its registry and issued a public advisory urging developers to uninstall any of the affected modules immediately.

Future Mitigation Strategies

Experts recommend a multi‑layered defense: (1) automated malware scanning of every newly published package, (2) mandatory two‑factor authentication for package maintainers, (3) encouraging developers to pin dependencies to verified versions, and (4) end‑users enabling browser‑level anti‑bot protections. Implementing these measures could dramatically reduce the risk of similar botnet‑forming campaigns in the future.