# 148 Malicious npm Packages ('Lucide Proxy') Disguise as School Wi-Fi Bypass / Tutoring Proxies to Hijack Browsers into a DDoS Botnet

> SafeDep and JFrog identified 148 npm packages, published by accounts terminal3airport (May) and a second unnamed account (July 8), branded 'Lucide Proxy' behind fake 'Riverbend Tutoring' and 'Northstar Tutoring' landing pages, that abuse a Scramjet-based service-worker web proxy to serve popunder ads/tracking and, in a mid-May build, add a mutable GitHub/jsDelivr remote script loader and a Wisp-protocol WebSocket flood generator that turned visitor browsers into a distributed DDoS botnet (up to ~2GB/s HTTP flood against cdn.caan.edu from 1,000 concurrent tabs, plus WebSocket socket-exhaustion floods against lunaron[.]top).

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1296
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-lucide-proxy-npm-ddos-botnet-tl-2026-1296.webp?v=c768856c (Threadlinqs threat intel: Lucide Proxy Botnet via Visitor Browsers: Detection & IOCs (TL-2026-1296) — High severity, 31 IOCs, 9 detection rules.)
- **ID:** TL-2026-1296
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

Beginning in March 2026 as a plain adware campaign, an npm account (terminal3airport, registered under a disposable Gmail address) published a browser-based web-proxy tool branded 'Lucide Proxy' disguised behind two fake tutoring-service landing pages, 'Northstar Tutoring' and 'Riverbend Tutoring,' both claiming to operate out of Portland, Oregon. The tool was designed to let students on school or workplace networks bypass content-filtering Wi-Fi restrictions to reach games and blocked sites. Each npm package's `package.json` sets `main: sw.js` with no npm install hooks, meaning the packages function purely as static web-asset bundles hosted for free on the npm registry/jsDelivr CDN rather than as consumable Node.js modules — an abuse of the public registry as disposable, unauthenticated CDN infrastructure.

The `sw.js` service worker registers capture-phase fetch-event listeners and routes all same-origin traffic through the open-source Scramjet web-proxy engine, injecting a script into every proxied HTML response. That injected script hooks `window.open`, anchor clicks, and form submissions to intercept new-tab navigation and relay it back to the parent frame via `postMessage`, and on first user interaction (click, keypress, or touch) triggers a popunder ad to `abdct[.]com` gated by a 15-minute localStorage cooldown. All 141 originally-cataloged packages phone home to a single Google Analytics property (G-0VL3ZSBXDH) and load monetization/ad scripts from `cdn.21baseballacademy.com` and `woofbeginner.com`.

Publication occurred in three waves under the terminal3airport account: May 7 (2 packages, v1.1.3, unobfuscated readable source, 'Northstar Tutoring' branding), May 26 (23 packages, v1.1.2, hex-obfuscated JavaScript with randomized filenames, 'Riverbend Tutoring' branding), and May 27 (116 packages, v1.1.7, mass-published in under 35 minutes via a bundled `auto-publish.sh` shell script that rewrote `package.json` name fields and republished in batches of 3). JFrog's deobfuscation of the 5.4 MB single-line minified entry bundle unpacked into over 20,600 lines of readable code and, cross-referenced with archived payloads pulled from the Wayback Machine, revealed that within 48 hours in mid-May the operators quietly added two additional hidden modules absent from SafeDep's initial adware-only classification:

**Module G2 (remote script loader):** fetches and executes arbitrary JavaScript from the mutable `main` branch of a GitHub repository via the `cdn.jsdelivr.net/gh/...` CDN path, with no Subresource Integrity (SRI) hash pinning. Because jsDelivr's `gh` endpoint mirrors whatever is currently on the branch, this let the operators re-arm or change the payload running in every visitor's browser at will, without any npm package update — the fetched code executes with the proxy site's own origin privileges, i.e. full access to cookies, localStorage, and same-origin endpoints.

**Module I2 (WebSocket flood generator / DDoS engine):** opens 1–30 (up to the browser's 1,024-socket ceiling) WebSocket connections that speak the Wisp proxy protocol, sending valid Wisp CONNECT and CLOSE frames every 100ms directed at `localhost:1` against a targeted `wisp-server-node` endpoint. Because `wisp-server-node` allocates a fresh socket per CONNECT frame without validating whether the destination is a loopback/private address, and logs every attempt, a single fully-loaded browser tab can drive a target Wisp server to allocate and tear down roughly 10,240 connections/second while writing 20,000+ log lines/second — exhausting file descriptors and log storage and crashing the proxy. Separately, an HTTP-flood mode issued randomized-query-parameter, no-cors GET requests (defeating browser/CDN caching) against `cdn.caan.edu`, a nursing-school CDN in Matteson, Illinois; JFrog measured roughly 2MB/s of upload traffic per participating browser, i.e. ~2GB/s aggregate from 1,000 concurrent open proxy tabs. WebSocket-flood traffic separately targeted the `lunaron[.]top` Wisp endpoint, which also injected malvertising into flood participants.

The malicious G2/I2 modules were quietly removed around May 31, coinciding with the start of public reporting. A second wave launched July 8 under a new, as-yet-unnamed npm account brought the total package count to 148 and shipped a 'cleaned up,' adware-only build without the DDoS modules re-included — however, as of July 14, 2026 (report date), specific packages under the 'charlie-kirk' name (versions 2.0.0 and 3.0.1) were still observed serving malicious code, indicating the campaign remains active and evolving rather than fully retired.

Attribution indicators point to a young, likely non-professional operator rather than an organized APT: package names include juvenile/meme strings such as `charlie-kirk`, `ilovefemboys`, `miguelphonk`, `ratelimitsucks`, `ishowfeet1`-`ishowfeet20`, and `abuden1`-`abuden230`; the bundled `auto-publish.sh` automation script was left inside published tarballs; and SafeDep discovered a literal 'TY WAVES + CHATGPT ILY' comment inside the service-worker source, implying AI-assisted (ChatGPT) development. JFrog traced the GitHub organization hosting the malicious modules to `github.com/lucideproxy` (repo `lucideproxy/svg`), whose member accounts were registered mere seconds apart, tied to a commit email at the `geeked.wtf` domain and an associated Discord handle authenticated via a Discord OAuth flow (verification hash `bb7ce9f4c508bc87f13889c18031ca42ad8c1bd5`). Of 93 distinct deployment hostnames identified, 90 resolved to a single IP address, 92.38.177.17, hosted by G-Core Labs — a hosting pattern consistent with a single small-scale operator rather than distributed infrastructure. SVG assets bundled in the packages reference AI platforms (Anthropic, OpenAI, DeepSeek) and Roblox, consistent with the tool's intended student audience seeking to bypass school content filters to reach AI chatbots, games, and Roblox.

This campaign is notable less for technical sophistication and more for its abuse model: it demonstrates that public package registries doubling as free, unauthenticated CDN hosting for client-side web assets (rather than as a source of installed dependencies) sidesteps most existing npm supply-chain defenses, which focus on install-time (`postinstall`) hooks and packages that are actually pulled into build pipelines. Because these packages set no install hooks and are never `npm install`ed by a build system — they are fetched directly as static assets by browsers visiting the tutoring-proxy landing pages — conventional dependency-scanning and SCA tooling that gates on install-time behavior would not have flagged them.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1587.001 Malware
- T1583.006 Web Services
- T1195.002 Compromise Software Supply Chain
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1059.007 JavaScript
- T1176 Software Extensions
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1027.010 Command Obfuscation
- T1036 Masquerading
- T1199 Trusted Relationship
- T1185 Browser Session Hijacking
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1571 Non-Standard Port
- T1104 Multi-Stage Channels
- T1498.001 Direct Network Flood
- T1499.003 Application Exhaustion Flood
- T1496 Resource Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Lucide Proxy — Popunder Ad / Monetization Beacon to Known Campaign Domains** (`TL-2026-1296-SPL-002`)

Detects outbound requests from browser clients to the campaign's known ad/monetization and popunder domains (abdct.com, woofbeginner.com, cdn.21baseballacademy.com) that the injected Scramjet proxy script fires on first user interaction (click/keypress/touch), gated by a 15-minute localStorage cooldown. This is the primary adware/tracking indicator, and its presence alongside a service-worker registration confirms active Lucide Proxy participation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1185, T1071.001
- **Data sources:** web_gateway_proxy_logs, dns_logs, firewall_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="web_gateway"
| eval campaign_domain=if(match(dest_host, "(?i)(abdct\.com|woofbeginner\.com|21baseballacademy\.com)"), 1, 0)
| where campaign_domain=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, dest_host, user
| where count > 0
| table first_seen, last_seen, src_ip, user, dest_host, count
| sort - count
```

### Microsoft KQL

```kql
ProxyHttpLogs
| where TimeGenerated > ago(24h)
| where DestinationHostName has_any ("abdct.com", "woofbeginner.com", "21baseballacademy.com")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RequestCount=count() by SourceIp, UserPrincipalName, DestinationHostName
| order by RequestCount desc
```

### Sigma

```yaml
title: Popunder Ad Beacon to Known Lucide Proxy Monetization Domains
id: 9d2f4b3a-6c7e-4a1b-8d3f-2e5a6b7c8d9e
status: experimental
description: Detects outbound browser traffic to abdct.com, woofbeginner.com, or cdn.21baseballacademy.com — the popunder/ad-monetization infrastructure fired by the Lucide Proxy injected service-worker script on first user interaction.
references:
    - https://safedep.io/malicious-npm-terminal3airport-proxy-adware-spam/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-14
tags:
    - attack.collection
    - attack.t1185
    - attack.command-and-control
    - attack.t1071.001
logsource:
    category: proxy
    product: web_gateway
detection:
    selection:
        dest_host|contains:
            - 'abdct.com'
            - 'woofbeginner.com'
            - '21baseballacademy.com'
    condition: selection
falsepositives:
    - Rare; these are dedicated campaign infrastructure domains with no known legitimate use
level: high
```

**Known false positives:**

- None expected — dedicated campaign infrastructure with no legitimate traffic; verify domain is not shared/parked ad infra before high-confidence blocking

**Tuning notes:** Add newly discovered ad/monetization domains as JFrog/SafeDep publish updated IOC lists; correlate with the preceding service-worker registration detection (SPL-001) to raise confidence.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Lucide Proxy — Masqueraded npm Package Fetch (main:sw.js, No Install Hooks) via CDN (locked: unlock with TL Creds)
- Lucide Proxy — Mutable jsDelivr GitHub-Branch Script Fetch with No Subresource Integrity (Module G2) (locked: unlock with TL Creds)
- Lucide Proxy — Wisp-Protocol WebSocket CONNECT/CLOSE Flood Against Loopback Target (Module I2) (locked: unlock with TL Creds)
- Lucide Proxy — Capture-Phase Fetch Listener Registration Consistent with Scramjet Proxy Hijack (locked: unlock with TL Creds)
- Lucide Proxy — Obfuscated/Mass-Published npm Package Artifact (auto-publish.sh Batch Pattern) (locked: unlock with TL Creds)
- Lucide Proxy — Registry/File Artifact Consistent with Injected Proxy Origin-Privilege Access (postMessage Relay) (locked: unlock with TL Creds)
- Lucide Proxy — Malicious Service Worker Registration from Tutoring-Proxy Landing Page (locked: unlock with TL Creds)
- Lucide Proxy — Sustained Anomalous Outbound Browser Upload Volume (HTTP Flood Participation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- IP address: `92.38.177[.]17`
- Domain: `woofbeginner[.]com`
- URL: `hxxps://cdn[.]jsdelivr[.]net/gh/canyoupleasesaysomething/cdn/main/cdn.js`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [150+ NPM Packages Promises Wi-Fi Bypass But Attacks Students Devices](https://cybersecuritynews.com/150-npm-packages-promises-wi-fi-bypass-students/)
- [148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet](https://thehackernews.com/2026/07/148-npm-packages-disguised-as-student.html)
- [141 npm Packages Abuse Registry as Adware Hosting](https://safedep.io/malicious-npm-terminal3airport-proxy-adware-spam/)
- [JFrog Security Research](https://research.jfrog.com/)
- [JFrog Blog](https://jfrog.com/blog/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1296