148 npm Packages Turned Students' Browsers into a DDoS Botnet

JFrog has published research on a campaign in which attackers used the npm registry in a way it was never meant to be used. Instead of targeting the developers who install packages, the campaign's operators employed the registry as free hosting for a malicious proxy site.

How the scheme worked

In total, 148 packages were identified, disguised as student web proxies — tools typically used to bypass restrictions such as school or corporate filters. Users searching for such a proxy ended up on a site concealed within the npm packages.

When a user visited the site, the victim's browser became part of a distributed network that was used to carry out DDoS attacks. The target of the attack, then, turned out to be not developers but ordinary students trying to get around network access restrictions.

Duration of the campaign

According to JFrog, the campaign remained active for about two weeks in May. During that time, the operators used the browsers of the site's visitors as a resource for launching attacks on third-party targets.

Why the finding matters

The case demonstrates that package repositories such as npm can be leveraged by attackers not only to distribute malicious code among developers, but also as infrastructure for hosting phishing or malicious web pages aimed at end users. The researchers note the unusual choice of audience — the attack was designed to target students looking for ways to bypass network blocks.

Source: The Hacker News