Beginning in March 2026 as a plain adware campaign, an npm account (terminal3airport, registered under a disposable Gmail address) published a browser-based web-proxy tool branded 'Lucide Proxy' disguised behind two fake tutoring-service landing pages, 'Northstar Tutoring' and 'Riverbend Tutoring,' both claiming to operate out of Portland, Oregon. The tool was designed to let students on school or workplace networks bypass content-filtering Wi-Fi restrictions to reach games and blocked sites. Each npm package's `package.json` sets `main: sw.js` with no npm install hooks, meaning the packages function purely as static web-asset bundles hosted for free on the npm registry/jsDelivr CDN rather than as consumable Node.js modules — an abuse of the public registry as disposable, unauthenticated CDN infrastructure.

The `sw.js` service worker registers capture-phase fetch-event listeners and routes all same-origin traffic through the open-source Scramjet web-proxy engine, injecting a script into every proxied HTML response. That injected script hooks `window.open`, anchor clicks, and form submissions to intercept new-tab navigation and relay it back to the parent frame via `postMessage`, and on first user interaction (click, keypress, or touch) triggers a popunder ad to `abdct[.]com` gated by a 15-minute localStorage cooldown. All 141 originally-cataloged packages phone home to a single Google Analytics property (G-0VL3ZSBXDH) and load monetization/ad scripts from `cdn.21baseballacademy.com` and `woofbeginner.com`.

Publication occurred in three waves under the terminal3airport account: May 7 (2 packages, v1.1.3, unobfuscated readable source, 'Northstar Tutoring' branding), May 26 (23 packages, v1.1.2, hex-obfuscated JavaScript with randomized filenames, 'Riverbend Tutoring' branding), and May 27 (116 packages, v1.1.7, mass-published in under 35 minutes via a bundled `auto-publish.sh` shell script that rewrote `package.json` name fields and republished in batches of 3). JFrog's deobfuscation of the 5.4 MB single-line minified entry bundle unpacked into over 20,600 lines of readable code and, cross-referenced with archived payloads pulled from the Wayback Machine, revealed that within 48 hours in mid-May the operators quietly added two additional hidden modules absent from SafeDep's initial adware-only classification:

**Module G2 (remote script loader):** fetches and executes arbitrary JavaScript from the mutable `main` branch of a GitHub repository via the `cdn.jsdelivr.net/gh/...` CDN path, with no Subresource Integrity (SRI) hash pinning. Because jsDelivr's `gh` endpoint mirrors whatever is currently on the branch, this let the operators re-arm or change the payload running in every visitor's browser at will, without any npm package update — the fetched code executes with the proxy site's own origin privileges, i.e. full access to cookies, localStorage, and same-origin endpoints.

**Module I2 (WebSocket flood generator / DDoS engine):** opens 1–30 (up to the browser's 1,024-socket ceiling) WebSocket connections that speak the Wisp proxy protocol, sending valid Wisp CONNECT and CLOSE frames every 100ms directed at `localhost:1` against a targeted `wisp-server-node` endpoint. Because `wisp-server-node` allocates a fresh socket per CONNECT frame without validating whether the destination is a loopback/private address, and logs every attempt, a single fully-loaded browser tab can drive a target Wisp server to allocate and tear down roughly 10,240 connections/second while writing 20,000+ log lines/second — exhausting file descriptors and log storage and crashing the proxy. Separately, an HTTP-flood mode issued randomized-query-parameter, no-cors GET requests (defeating browser/CDN caching) against `cdn.caan.edu`, a nursing-school CDN in Matteson, Illinois; JFrog measured roughly 2MB/s of upload traffic per participating browser, i.e. ~2GB/s aggregate from 1,000 concurrent open proxy tabs. WebSocket-flood traffic separately targeted the `lunaron[.]top` Wisp endpoint, which also injected malvertising into flood participants.

The malicious G2/I2 modules were quietly removed around May 31, coinciding with the start of public reporting. A second wave launched July 8 under a new, as-yet-unnamed npm account brought the total package count to 148 and shipped a 'cleaned up,' adware-only build without the DDoS modules re-included — however, as of July 14, 2026 (report date), specific packages under the 'charlie-kirk' name (versions 2.0.0 and 3.0.1) were still observed serving malicious code, indicating the campaign remains active and evolving rather than fully retired.

Attribution indicators point to a young, likely non-professional operator rather than an organized APT: package names include juvenile/meme strings such as `charlie-kirk`, `ilovefemboys`, `miguelphonk`, `ratelimitsucks`, `ishowfeet1`-`ishowfeet20`, and `abuden1`-`abuden230`; the bundled `auto-publish.sh` automation script was left inside published tarballs; and SafeDep discovered a literal 'TY WAVES + CHATGPT ILY' comment inside the service-worker source, implying AI-assisted (ChatGPT) development. JFrog traced the GitHub organization hosting the malicious modules to `github.com/lucideproxy` (repo `lucideproxy/svg`), whose member accounts were registered mere seconds apart, tied to a commit email at the `geeked.wtf` domain and an associated Discord handle authenticated via a Discord OAuth flow (verification hash `bb7ce9f4c508bc87f13889c18031ca42ad8c1bd5`). Of 93 distinct deployment hostnames identified, 90 resolved to a single IP address, 92.38.177.17, hosted by G-Core Labs — a hosting pattern consistent with a single small-scale operator rather than distributed infrastructure. SVG assets bundled in the packages reference AI platforms (Anthropic, OpenAI, DeepSeek) and Roblox, consistent with the tool's intended student audience seeking to bypass school content filters to reach AI chatbots, games, and Roblox.

This campaign is notable less for technical sophistication and more for its abuse model: it demonstrates that public package registries doubling as free, unauthenticated CDN hosting for client-side web assets (rather than as a source of installed dependencies) sidesteps most existing npm supply-chain defenses, which focus on install-time (`postinstall`) hooks and packages that are actually pulled into build pipelines. Because these packages set no install hooks and are never `npm install`ed by a build system — they are fetched directly as static assets by browsers visiting the tutoring-proxy landing pages — conventional dependency-scanning and SCA tooling that gates on install-time behavior would not have flagged them.