148 npm Packages Disguised as Student Tutoring Proxies Turn Browsers Into DDoS Botnet (Lucide Proxy)
148 npm Packages Disguised as Student Tutoring Proxies Turn (TL-2026-1304), also tracked as Lucide Proxy Campaign, is a high-severity malware campaign, first published 2026-07-14. It has no confirmed attribution, affects npm, Inc. (npmjs.com registry) npm packages published under accounts, maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-1304
- Threat ID
- TL-2026-1304
- Also known as
- Lucide Proxy Campaign, lucideproxy DDoS botnet
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- education, students, content-delivery, open-source-supply-chain
- Target regions
- Global, North America
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in 148 npm Packages Disguised as Student Tutoring Proxies Turn
Malware and tooling: Lucide Proxy / module G2 (remote loader), module I2 (HTTP/WebSocket flood generator), Baremux, Scramjet (@mercuryworkshop/scramjet)
Between March and July 2026 the npm accounts 'terminal3airport' and a related follow-on account published 148 packages branded 'Lucide Proxy' and disguised as tutoring landing pages ('Riverbend Tutoring', 'Northstar Tutoring') to help students bypass school web filters. A remote-code loader ('G2') fetched unpinned JavaScript from the mutable main branch of GitHub org lucideproxy via jsDelivr with no Subresource Integrity, and for a roughly two-week window in mid-to-late May 2026 silently deployed an HTTP-flood and WebSocket-flood module ('I2') that conscripted visiting browsers into a DDoS botnet targeting a nursing-school CDN (cdn.caan.edu) and rival Wisp proxy infrastructure (lunaron.top).
How 148 npm Packages Disguised as Student Tutoring Proxies Turn works
The Lucide Proxy campaign is npm-registry-as-CDN abuse layered with a covert browser-based DDoS botnet. The operators, assessed as a young/opportunistic actor rather than an APT, published 141 near-identical npm packages under the account 'terminal3airport' between May 7 and May 27, 2026 (package names such as changiairportpromax, ilovefemboys, backup1-gg through backup5-updated, ishowfeet1-20, nottuff1-30, abuden1-230), each shipping a byte-identical payload apart from package.json's name field. Every package's main entry point was a service worker (sw.js) implementing a web-proxy 'unblocker' built on the Mercury Workshop Scramjet proxy-rewriting engine and the Baremux transport library, relocated inside the tarball to obfuscated directory names (runtime/scramjet -> 8cfc2/, runtime/baremux -> d1g0y/). The service worker intercepted all fetch events on its origin, routed traffic through Scramjet's rewriting engine, and injected a script into every proxied HTML response that hooked window.open, anchor clicks, and form submissions to relay new-tab navigation to the parent frame via postMessage -- the injected flag window.open.__lucideIntercepted named the project. Branding assets referencing Anthropic, OpenAI, DeepSeek, xAI, Gemini, and Roblox indicate the sites specifically targeted students trying to reach AI chatbots and gaming sites from school networks. Monetization used popunder ads (cooldown 900,000ms / 15 minutes), third-party tracking scripts, and Google Analytics (G-0VL3ZSBXDH).
A second GitHub organization, lucideproxy (repo github.com/lucideproxy/svg), hosted a remote script loader referred to by JFrog as module 'G2'. G2 fetched JavaScript through the jsDelivr CDN pointed at the org's mutable main branch rather than a pinned commit, shipped with no Subresource Integrity hash, and executed the fetched code with the proxy site's own origin privileges -- full access to cookies, local storage, and same-origin endpoints. This let the operators swap the delivered payload at will without republishing to npm. In mid-May 2026 (~2-day burst) the operators pushed module 'I2', an HTTP/WebSocket flood generator, live through this loader. I2's HTTP-flood component POSTed a roughly 1-million-character payload every 500ms, producing about 2MB/second of upload traffic per active browser (roughly 2GB/second aggregate across 1,000 simultaneous tabs). I2's WebSocket-flood component fetched a target list from websocket.txt and opened up to 1,024 concurrent WebSocket connections per browser, sending valid Wisp proxy-protocol CONNECT/CLOSE frames every 100ms against localhost:1 on remote Wisp servers -- generating on the order of 10,240 connection cycles/second per browser. This is a control-plane DDoS rather than a purely volumetric one: it exhausts file descriptors and floods logs on the target Wisp infrastructure rather than simply saturating bandwidth. Confirmed live-fire targets were cdn.caan.edu, the CDN of a nursing school in Matteson, Illinois, and lunaron.top, a rival Wisp proxy endpoint -- meaning part of the campaign's DDoS traffic was aimed at competing student-proxy services. End of May 2026, JFrog and SafeDep began investigating after live-flood traffic was observed; the operators stripped the malicious DDoS modules from the loader on 2026-05-31 once reporting began, reverting to adware-only behavior. On 2026-07-08 a second wave under a new/related account republished the cleaned-up adware-only build, bringing the campaign total to 148 packages; by 2026-07-14, most packages had been removed from npm, though the charlie-kirk package (versions 2.0.0 and 3.0.1) remained live.
Attribution: no known APT group. Both JFrog and SafeDep independently assess the operator as young/juvenile based on: package names (charlie-kirk, ilovefemboys, miguelphonk, ishowfeet1-20), an auto-publish.sh shell script left inside published tarballs that parallel-published packages (3 concurrent processes) with dynamically generated names, npm/GitHub accounts registered seconds apart, 116 packages pushed to the lucideproxy GitHub org in under 35 minutes, a Discord-linked commit email (geeked.wtf), and a 'TY WAVES + CHATGPT ILY' comment SafeDep recovered from the service worker source. JFrog deobfuscated the 5.4MB single-line entry bundle into more than 20,600 lines of readable code and recovered archived historical payloads via the Wayback Machine to reconstruct the DDoS-module timeline after the operators stripped it from the live repository.
Infrastructure: 90 of 93 observed deployment hostnames for the proxy sites resolved to a single IP, 92.38.177.17, hosted at G-Core Labs. Secondary domains used for ad monetization and script hosting included woofbeginner.com, c.vipersfutbol.com, abdct.com, 21baseballacademy.com and cdn.21baseballacademy.com. No CVE was assigned; the vulnerability class is a supply-chain trust failure (unpinned, non-integrity-checked remote code execution via jsDelivr/GitHub) rather than a memory-safety or logic bug in a specific product.
MITRE ATT&CK techniques used in TL-2026-1304
Collection
T1005 Data from Local System; T1185 Browser Session Hijacking
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.007 JavaScript; T1204.001 Malicious Link
Command and Control
T1071.001 Web Protocols; T1090.002 External Proxy; T1095 Non-Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer
Persistence
T1176 Software Extensions; T1505.003 Web Shell
Initial Access
T1189 Drive-by Compromise; T1195.002 Compromise Software Supply Chain
Impact
T1496 Resource Hijacking; T1498.001 Direct Network Flood; T1499.002 Service Exhaustion Flood; T1499.004 Application or System Exploitation
Resource Development
T1583.006 Web Services; T1584 Compromise Infrastructure; T1585 Establish Accounts; T1587.001 Malware
command-and-control
Affected products and versions in 148 npm Packages Disguised as Student Tutoring Proxies Turn
- npm, Inc. (npmjs.com registry) — npm packages published under accounts terminal3airport and lucideproxy-linked follow-on account
Vulnerable versions: all 148 identified package publishes, May-July 2026, including versions 1.1.2, 1.1.3, 1.1.7; charlie-kirk 2.0.0; charlie-kirk 3.0.1
Fixed in: packages removed from registry as of 2026-07-14 except charlie-kirk 2.0.0/3.0.1 - Web browsers (any, via visited proxy site) — End-user browser sessions visiting Lucide/Riverbend/Northstar Tutoring proxy pages
Vulnerable versions: any browser with JavaScript/service-worker support visiting the malicious proxy sites, March-July 2026
Fixed in: N/A - client-side conscription, not a browser vulnerability
Remediation for 148 npm Packages Disguised as Student Tutoring Proxies Turn
Immediate actions
- DNS/firewall-block all listed Lucide Proxy infrastructure domains and the 92.38.177.17 hosting IP
- Audit npm manifests and lockfiles across all projects for any of the 148 identified package names (including terminal3airport-published names such as changiairportpromax, ishowfeet1-20, nottuff1-30, abuden1-230, backup1-gg through backup5-updated) and the charlie-kirk package which remained live as of 2026-07-14
- Purge browser artifacts (cache, local storage, IndexedDB, and registered service workers) on any endpoint that visited a Lucide/Riverbend/Northstar Tutoring proxy page
- Block outbound access to jsDelivr-fronted content from github.com/lucideproxy/svg at the web/DNS proxy layer for managed school or enterprise networks
Workarounds
- Block or filter access to known student-proxy/unblocker sites at the network layer for school and enterprise networks where policy requires it
- Disable service-worker registration for unmanaged/unapproved origins via browser policy (e.g., Chrome ServiceWorkerAllowedOrigins / ExtensionInstallBlocklist equivalents)
Longer-term hardening
- Enforce Subresource Integrity (SRI) and commit-pinning policy for any CDN-loaded third-party JavaScript in managed environments
- Deploy network egress monitoring for high-frequency WebSocket connection churn (Wisp CONNECT/CLOSE cadence) and repetitive large POST bodies indicative of browser-based DDoS modules
- Restrict unvetted npm package installation on managed/education-network endpoints via allowlisting or a package-reputation gate
Weaknesses (CWE) in 148 npm Packages Disguised as Student Tutoring Proxies Turn
CWE-494, CWE-829, CWE-1104, CWE-400
Timeline of 148 npm Packages Disguised as Student Tutoring Proxies Turn
- Lucide Proxy campaign begins as adware-only student-proxy distribution disguised as tutoring landing pages.
- npm account 'terminal3airport' begins publishing 141 near-identical packages disguised as tutoring/proxy tools; publishing continues through May 27 using an auto-publish.sh script with 3 concurrent processes.
- Operators push the I2 HTTP/WebSocket flood module live through the unpinned G2 remote loader for a roughly 2-day burst window (mid-May 2026).
- SafeDep publishes an advisory cataloging 141 malicious npm packages tied to the terminal3airport account and the lucideproxy/svg GitHub repository.
- Live DDoS flood traffic observed against cdn.caan.edu (nursing school CDN) and lunaron.top (rival Wisp proxy endpoint) as researchers begin investigating.
- Operators strip the DDoS modules (G2 payload swap, I2 flood generator) from the GitHub loader after reporting/investigation begins, reverting to adware-only behavior.
- A second, related npm account publishes a cleaned-up adware-only build, bringing the campaign's cumulative package count to 148.
- JFrog deobfuscates the 5.4MB single-line entry bundle into 20,600+ lines of readable code and recovers historical DDoS-module payloads via the Wayback Machine.
- JFrog research and The Hacker News publicly disclose the full campaign, including the DDoS botnet mechanics; most of the 148 packages have been removed from npm, though charlie-kirk versions 2.0.0 and 3.0.1 remain live.
Sources cited for 148 npm Packages Disguised as Student Tutoring Proxies Turn
- 148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet
- 141 npm Packages Abuse Registry as Adware Hosting
- lucideproxy/svg - IOC - SafeDep Threat Intelligence
- Active Exploitation Alert: 148 Malicious npm Packages Masquerading as Student Proxies Turn Browsers Into DDoS Botnet
- 150+ npm Packages Promises Wi-Fi Bypass Students Using Their Systems for DDoS Attack
- 148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet (GuardianMSSP)
- JFrog Security Research
- @mercuryworkshop/scramjet - npm Package Security Analysis
- @mercuryworkshop/scramjet - npm
- npm supply-chain attacks escalate; Zimbra RCE, Android malware
Threats related to 148 npm Packages Disguised as Student Tutoring Proxies Turn
Detection coverage for TL-2026-1304
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1304 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.