Loading story…
Researchers reported a campaign involving 148 npm packages that masqueraded as student proxy, school Wi-Fi bypass, and tutoring tools while secretly turning visitors’ browsers into a browser-based DDoS botnet. The packages, tied to Lucide Proxy branding and related names such as Riverbend Tutoring and Northstar Tutoring, were used mainly to host proxy web pages rather than infect developers during npm install. JFrog and SafeDep found the operation evolved from adware and tracking activity into active traffic-flooding behavior, with hidden scripts, service workers, and obfuscated JavaScript loading mutable second-stage code from remote infrastructure.
Archived payloads showed one module sending repeated large POST requests at cdn.caan.edu, while another opened rapid WebSocket connections against a Wisp-compatible endpoint at lunaron[.]top. Researchers linked much of the infrastructure to a lucideproxy GitHub organization and a G-Core Labs-hosted IP, 92.38.177[.]17, and said the attackers removed overt DDoS modules on May 31 while preserving the ability to restore them through a remote branch; a later wave on July 8 expanded the package count. Many packages were removed from npm, but some malicious versions reportedly remained available, and defenders were urged to review browser telemetry, DNS and web-filtering logs, clear affected browsers’ site data and service workers, and rotate credentials used through the proxy pages.
Trace attribution and downstream blast radius.
7 events from the most recent confirmed update back to the earliest known activity.
SafeDep first documented 141 related npm packages in May, describing them as abuse tied to adware-hosting proxy pages masquerading as student-focused services.
JFrog reported that the operation shifted from adware to active browser-based DDoS behavior in mid-May, using remote JavaScript and traffic-flooding modules loaded by the hosted proxy pages.
JFrog said the npm package campaign initially operated as adware in March before later evolving into browser-based DDoS functionality.
As of 2026-07-14, many packages had been removed from npm, but JFrog said at least some malicious versions were still available.
JFrog said a later wave began on 2026-07-08, increasing the total number of identified npm packages in the campaign to 148.
On 2026-05-31, the campaign removed overt malicious modules from the npm packages as scrutiny increased, while retaining the ability to re-enable malicious behavior through mutable remote code.
JFrog said the first wave of the campaign began on 2026-05-27, tied to Lucide Proxy branding and packages that served proxy-site assets while exposing visitors to malicious second-stage code.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 47 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
5 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcecybersecuritynews.com
Open sourcetrojan-killer.net
Open sourcethehackernews.com
Open sourceresearch.jfrog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor identified as 'dino_reborn' published seven packages to the npm registry, six of which contain malicious JavaScript designed to redirect victims to cryptocurrency scam sites. These packages leverage the Adspect cloud-based service to implement cloaking techniques, distinguishing between regular users and security researchers by collecting browser and environment data. If a visitor is identified as a potential victim, they are shown a fake CAPTCHA and ultimately redirected to a malicious site, while researchers are served a decoy page to evade detection. The packages involved are: signals-embed, dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830, with only signals-embed acting as a decoy and the rest containing the 39kB malicious payload. The malicious code is automatically executed in the browser via an Immediately Invoked Function Expression (IIFE) and includes anti-analysis features such as blocking right-click, F12, and other developer tools shortcuts, as well as reloading the page if DevTools is detected. The Socket Threat Research Team discovered the campaign and submitted takedown requests, resulting in npm placing the packages in security holding. The attack highlights the increasing sophistication of supply chain threats in open-source ecosystems, particularly through the use of advanced cloaking and anti-analysis techniques to evade detection and target end users.
Jun 29, 2026
Researchers disclosed a campaign using **24 malicious npm packages** as phishing infrastructure, abusing package CDN mirrors such as **unpkg** to publish a single HTML file that renders a fake **Cloudflare CAPTCHA** page. Instead of targeting developers through dependency compromise or malware-laced code, the packages were designed to exploit the trust and availability of npm mirror services, giving attackers a seemingly legitimate hosting channel for phishing content. The operation reportedly evolved after an earlier **Microsoft-themed typosquatted domain** was blocked by Google Chrome Safe Browsing, with the attackers shifting to **KeyVal** as a dead-drop resolver to control redirection targets. Researchers said the current lure redirects users to the legitimate **ChatGPT** website, but warned the same infrastructure can be quickly repointed to **ClickFix-style phishing** pages or malware delivery sites, turning public package mirrors into flexible staging points for social-engineering attacks.
Aug 27, 2026
Security researchers reported multiple self-propagating npm supply-chain malware campaigns that used compromised maintainer accounts and poisoned package updates to infect developer and CI/CD environments. JFrog said **IronWorm** was distributed through 36–37 malicious npm packages republished from the compromised `asteroiddao` account, where `preinstall` hooks launched a Rust ELF payload on Linux. The malware stole credentials and secrets tied to AWS, npm, SSH, Vault, OpenAI, Anthropic, Kubernetes, and Exodus wallets, hid with an **eBPF rootkit**, and used **Tor** for command-and-control. Investigators also linked the activity to poisoned GitHub repositories across nine organizations, including backdated malicious commits attributed to spoofed automation identities such as `claude`, `dependabot[bot]`, `renovate[bot]`, and `github-actions[bot]`. A separate but related wave, tracked by Sonatype as **Shai-Hulud "Miasma"**, pushed 281 malicious npm package versions and used `binding.gyp` with `node-gyp` to execute during installation, bypassing defenses that only inspect lifecycle scripts. Like IronWorm, the malware harvested developer and CI/CD secrets, validated stolen access, and republished trojanized versions of legitimate packages to continue spreading through repositories, build systems, and registries. Researchers said active exploitation was observed in the wild and warned that public impact may understate the full scope, particularly where private projects and CI runners were exposed through trusted publishing flows and compromised maintainer credentials.
Jul 12, 2026