This campaign involved the deployment of 148 malicious npm packages masquerading as student web proxy applications published by accounts terminal3airport and eerikakirk. These packages functioned as legitimate proxies but secretly executed mutable remote code and high-performance WebSocket traffic generators compatible with the Wisp protocol. The campaign weaponized visitor browsers into distributed denial-of-service (DDoS) botnets that launched HTTP floods and control-plane attacks generating massive traffic and socket connections against target servers. The abuse of npm as a content delivery network allowed the campaign to affect users who accessed proxy instances directly rather than through traditional dependency infections. The campaign was active during a critical two-week period in May 2026, with attacks generating aggregate traffic of 2GB/s and establishing 10,240 socket connections per second. Indicators include multiple malicious domains and hashes. The campaign targeted student users and leveraged browser-based attacks, adware, and supply chain abuse techniques.

The campaign weaponized browsers of users visiting malicious student proxy applications to create large-scale DDoS botnets capable of generating HTTP floods and WebSocket floods, resulting in significant volumetric and connection-based denial-of-service attacks against targeted servers. This could disrupt availability of targeted services and infrastructure. The abuse of npm as a content delivery network means that users were affected by visiting proxy instances rather than traditional software dependency infections. The campaign also generated advertising revenue for the attackers, indicating a financial motive alongside disruption. The impact was geographically noted in the United States.

No official patch or fix is available as this is a campaign abusing npm packages rather than a software vulnerability. Mitigation involves avoiding use of suspicious or untrusted student web proxy npm packages, verifying package authenticity before use, and monitoring for indicators of compromise such as the listed malicious domains and hashes. Users and organizations should be cautious about proxy services and npm packages from unverified sources. Since the campaign abuses browser execution, restricting or monitoring browser-based proxy usage may help. Check vendor advisories and npm security notices for updates or removals of malicious packages.