148 npm “student proxy” packages weaponized browsers into a DDoS botnet
JFrog uncovered 148 npm packages masquerading as student web proxies that hijacked visitors’ browsers into a coordinated DDoS botnet for about two weeks in May‑June 2026. The payload, delivered via a mutable loader, let attackers swap code on the fly and also served adware, showing a new supply‑chain threat that targets end‑users instead of developers.