Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: Medium
Victim: Students and educational network users
Incident: Malicious npm packages were used to host proxy sites that enrolled visitors into a DDoS botnet.
Impact: Unauthorized execution of remote code in user browsers and the creation of a distributed attack infrastructure.
Attacker: Unidentified threat actors
Analysis: This campaign represents a shift in registry abuse, utilizing the npm ecosystem as free hosting for malicious web pages rather than targeting the software supply chain. By deploying fake tutoring and proxy sites, attackers leveraged a remote script loader to execute arbitrary code and a WebSocket generator to recruit visitors into a DDoS swarm. This approach effectively bypasses traditional dependency scanners since the malicious code executes in the browser, not during package installation.
Recommendations: Implement strict DNS and web filtering to block unauthorized proxy services; Monitor network egress for unusual WebSocket flood patterns typical of DDoS activity; Educate users on the risks of using third-party ‘unblocking’ proxies to bypass security controls
Source: The Hacker News / JFrog
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source