148 Malicious npm Packages ('Lucide Proxy') Disguise as School Wi-Fi Bypass / Tutoring Proxies to Hijack Browsers into a DDoS Botnet — Threadlinqs Intelligence
As of 2026-07-14, 148 Malicious npm Packages ('Lucide Proxy') Disguise as School Wi-Fi Bypass / Tutoring Proxies to Hijack Browsers into a DDoS Botnet is a high-severity supply chain threat attributed to Unknown (operator of npm account terminal3airport, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-1296 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Unknown (operator of npm account terminal3airport · FINANCIAL
SafeDep and JFrog identified 148 npm packages, published by accounts terminal3airport (May) and a second unnamed account (July 8), branded 'Lucide Proxy' behind fake 'Riverbend Tutoring' and
Beginning in March 2026 as a plain adware campaign, an npm account (terminal3airport, registered under a disposable Gmail address) published a browser-based web-proxy tool branded 'Lucide Proxy' disguised behind two fake tutoring-service landing pages, 'Northstar Tutoring' and 'Riverbend Tutoring,' both claiming to operate out of Portland, Oregon. The tool was designed to let students on school or workplace networks bypass content-filtering Wi-Fi restrictions to reach games and blocked sites. Each npm package's `package.json` sets `main: sw.js` with no npm install hooks, meaning the packages function purely as static web-asset bundles hosted for free on the npm registry/jsDelivr CDN rather than as consumable Node.js modules — an abuse of the public registry as disposable, unauthenticated CDN infrastructure.
The `sw.js` service worker registers capture-phase fetch-event listeners and routes all same-origin traffic through the open-source Scramjet web-proxy engine, injecting a script into every proxied HTML response. That injected script hooks `window.open`, anchor clicks, and form submissions to intercept new-tab navigation and relay it back to the parent frame via `postMessage`, and on first user interaction (click, keypress, or touch) triggers a popunder ad to `abdct[.]com` gated by a 15-minute localStorage cooldown. All 141 originally-cataloged packages phone home to a single Google Analytics property (G-0VL3ZSBXDH) and load monetization/ad scripts from `cdn.21baseballacademy.com` and `woofbeginner.com`.
Publication occurred in three waves under the terminal3airport account: May 7 (2 packages, v1.1.3, unobfuscated readable source, 'Northstar Tutoring' branding), May 26 (23 packages, v1.1.2, hex-obfuscated JavaScript with randomized filenames, 'Riverbend Tutoring' branding), and May 27 (116 packages, v1.1.7, mass-published in under 35 minutes via a bundled `auto-publish.sh` shell script that rewrote `package.json` name fields and republished in batches of 3). JFrog's deobfuscation of the 5.4 MB single-line minified entry bundle unpacked into over 20,600 lines of readable code and, cross-referenced with archived payloads pulled from the Wayback Machine, revealed that within 48 hours in mid-May the operators quietly added two additional hidden modules absent from SafeDep's initial adware-only classification:
**Module G2 (remote script loader):** fetches and executes arbitrary JavaScript from the mutable `main` branch of a GitHub repository via the `cdn.jsdelivr.net/gh/...` CDN path, with no Subresource Integrity (SRI) hash pinning. Because jsDelivr's `gh` endpoint mirrors whatever is currently on the branch, this let the operators re-arm or change the payload running in every visitor's browser at will, without any npm package update — the fetched code executes with the proxy site's own origin privileges, i.e. full access to cookies, localStorage, and same-origin endpoints.
**Module I2 (WebSocket flood generator / DDoS engine):** opens 1–30 (up to the browser's 1,024-socket ceiling) WebSocket connections that speak the Wisp proxy protocol, sending valid Wisp CONNECT and CLOSE frames every 100ms directed at `localhost:1` against a targeted `wisp-server-node` endpoint. Because `wisp-server-node` allocates a fresh socket per CONNECT frame without validating whether the destination is a loopback/private address, and logs every attempt, a single fully-loaded browser tab can drive a target Wisp server to allocate and tear down roughly 10,240 connections/second while writing 20,000+ log lines/second — exhausting file descriptors and log storage and crashing the proxy. Separately, an HTTP-flood mode issued randomized-query-parameter, no-cors GET requests (defeating browser/CDN caching) against `cdn.caan.edu`, a nursing-school CDN in Matteson, Illinois; JFrog measured roughly 2MB/s of upload traffic per participating browser, i.e. ~2GB/s aggregate from 1,000 concurrent open proxy tabs. WebSocket-flood traffic separately targeted the
Weaknesses (CWE)
CWE-494, CWE-829, CWE-400, CWE-1021
Target sectors: education
Target regions: North America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1584, T1587.001, T1583.006, T1195.002, T1189, T1204.001, T1059.007, T1176, T1546, T1027