Fake Student Proxy Sites Turn Browsers Into DDoS Bots

How the attack worked

Attackers used 148 npm packages not as software for developers to install, but as free hosting for proxy websites disguised as tutoring pages, branded Riverbend Tutoring and Northstar Tutoring under a product name called Lucide. Students trying to get around school web filters visited these pages expecting a simple proxy to reach games or blocked sites. On the surface the proxy worked as advertised. Underneath, the page loaded a remote script loader pulled from a GitHub repository through the jsDelivr CDN, pointed at a mutable branch rather than a pinned commit, with no integrity check. That meant whoever controlled the GitHub account could change what ran in every visitor's browser at any time, without updating any package.

Why it succeeded

The attack succeeded because it exploited a blind spot in typical defenses. Dependency scanners and install-time sandboxes are designed to inspect code that runs when a package is installed. This code was never installed. It ran entirely as a web app in the browser once a student opened the page, so it bypassed the tooling most organizations rely on for supply chain protection. The mismatch between a page's stated purpose, tutoring, and its actual function, a filter-bypass proxy, also made it easy for students to overlook the risk. Because the payload was swappable at will, researchers observed at least two distinct behaviors: an HTTP flood sending large POST requests roughly every 500 milliseconds, and a module that opened many WebSocket connections to stress proxy infrastructure.

What to watch for

• A "tutoring" or study-help page that also functions as a filter-bypass proxy
• Unexplained browser slowness or high network usage after opening a page and leaving the tab open
• Frequent background POST requests or large outbound traffic from a single browser tab, observed at roughly 2 MB per second per visitor
• Automatic creation of many WebSocket connections without any user action
• Reliance on remote scripts loaded from mutable sources with no integrity checks

How to build resistance

Organizations and individuals can reduce exposure with a few concrete steps. Treat any free proxy or unblocker site as high risk, even when it is dressed up as a tutoring or homework help resource, and avoid using such sites on school or corporate networks. Network administrators should block known proxy and script-hosting domains tied to this campaign at the DNS level, since school and corporate networks generate the most traffic for these proxies. Anyone who has already visited one of these sites should clear browser cache and local storage and unregister any service worker left behind. Finally, recognize that malicious code does not need to be installed to run: a hosted web app can use a visitor's own browser as the execution environment, which is a gap that install-time scanning alone will not close.

How did fake tutoring sites turn browsers into DDoS bots?

Sites branded as Riverbend Tutoring or Northstar Tutoring actually hosted a proxy app called Lucide that let students bypass school filters, while secretly loading a remote script that could launch HTTP floods or open mass WebSocket connections against targets.

Why didn't dependency scanners catch this attack?

The malicious code never ran at npm install time. It was hosted as a web app that executed in the visitor's browser, so install-time scanners and sandboxes were never triggered.

What should network administrators do about this threat?

Block the campaign's known proxy and script-hosting domains at the DNS level on school and corporate networks, since these environments generate the most proxy traffic.

What should someone do if they visited one of these proxy sites?

Clear the browser cache and local storage and unregister any service worker left behind by the tutoring or proxy domain to remove persistence.