148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet
Students' browsers were covertly transformed into a DDoS botnet.
1A Covert Botnet Campaign
148 npm packages disguised as web proxies for students turned browsers into a DDoS botnet. These packages targeted students trying to bypass school filters rather than developers. The proxy apps were disguised as educational sites like Riverbend Tutoring and Northstar Tutoring.
2The Threat Beneath the Proxies
The proxy apps contained malicious components like a remote code loader and a WebSocket flood generator. Students unknowingly participated in a DDoS attack while using these proxies. The packages waited in the browser to launch the attack instead of being integrated into projects.
3JFrog's Investigation
JFrog decrypted the JavaScript code within the packages to uncover the campaign's timeline. Two modules were identified: G2 remote script loader and I2 WebSocket flood generator. These modules executed before the React interface rendered.
4HTTP and WebSocket Attacks
The G2 module fetched JavaScript code from GitHub to launch an HTTP flood attack. The I2 module opened WebSocket connections to execute a control-plane attack via the Wisp protocol. Both attacks overloaded the target servers.
5The Operators' Identity
The operators were traceable through GitHub and Discord accounts. Most packages were linked to a single IP address and contained auto-publish scripts. npm took no action to slow the rapid spread of these packages.
6Comparison with Previous Attacks
This campaign differed from previous npm attacks like the Shai-Hulud worm and qix phishing attack. Those attacks triggered during package installation, while this campaign waited in the browser to launch the attack.
7Security and Awareness
This incident raises awareness about the reliability of npm packages and students' use of proxies. Developers and students must be more vigilant against such threats and enhance security measures.