Malicious npm Packages Disguised as School Wi-Fi Bypass Tools Hijack Browsers for DDoS Attacks Researchers from JFrog and SafeDep uncovered a campaign involving nearly 150 malicious npm packages masquerading as legitimate school Wi-Fi bypass tools. The packages, branded under names like Lucide Proxy, Riverbend Tutoring, and Northstar Tutoring, promised students access to blocked websites and games while covertly loading harmful code in the background. Unlike traditional npm-based attacks that infect developers during installation, these packages functioned as delivery mechanisms for browser-based proxy pages. Visitors to the hosted sites were exposed to popunder ads, tracking scripts, and during a key period in late May traffic-flooding code designed to turn browsers into unwitting participants in DDoS attacks. The campaign operated in waves, with the first detected on May 27 and a second on July 8, bringing the total to 148 packages. While many were removed, some remained available at the time of disclosure. The attack leveraged npm’s infrastructure to distribute static web assets, then dynamically altered functionality via external scripts after visitors loaded the pages. ### How the Attack Worked The proxy services appeared to work as advertised, routing traffic to bypass restrictions while silently executing additional code. A service worker intercepted navigation events and injected scripts that: - Generated popunder ads after user interaction. - Loaded remote JavaScript from a mutable GitHub branch, allowing operators to update malicious payloads without republishing npm packages. - Flooded targets with traffic, including repeated large POST requests to an education-related site, capable of generating ~2 MB of upload traffic per second per browser. A thousand active users could produce ~2 GB/s, enough to disrupt services. - Abused WebSocket connections, rapidly opening and closing links to strain server resources. The remote loader and DDoS components were later removed, but the ability to fetch live scripts from external sources remained a persistent risk. ### Impact and Detection Challenges The campaign’s design made it difficult to detect and mitigate: - Victims weren’t limited to developers anyone visiting the proxy pages, including students, could unknowingly contribute browser resources. - Takedowns were hindered by the use of multiple package names and hosting locations. - Endpoint security tools focused on package installation might miss infections, as the malicious code executed post-page load. Security teams are advised to block the identified infrastructure domains, review web filtering logs for visits to tutoring-themed proxy pages, and monitor for unusual browser upload activity. Indicators of compromise (IoCs) include domains like whatsadmaidk[.]com, changiairportpromax[.]com, and IP addresses such as 92.38.177.17 and 53.75.225.178, along with specific file hashes and URLs tied to the campaign.