A single npm account, terminal3airport ( [email protected] ), published 141 packages between May 7 and May 27, 2026. Every package contains the same payload: a web proxy unblocker built on the Scramjet framework, disguised as a tutoring website, monetized through popunder ads and external tracking scripts. The packages carry no install hooks and no credential stealers. The attack is npm registry abuse: using the registry as free, disposable CDN infrastructure for adware distribution.
Indicators of Compromise (IoC):
All 141 packages are single-version publishes. Every package except package.json (which differs only in the name field) is byte-identical. SHA-256 of the shared index.html payload across the v1.1.2 and v1.1.7 generations: the content matches.
Three publishing waves stand out:
The v1.1.7 packages include the automation script that published them, left in the tarball:
The script rewrites the name field in package.json , publishes, and moves to the name. It processes 3 packages in parallel. The attacker ran variants of this script with different BASE prefixes ( nottuff , ishowfeet , abuden , sixseven , speed , imillegal , ratelimitsucks , timmytuffknuckles , backupsitetuff ) to produce the 116 packages in the May 27 wave. Package names like ishowfeet , ilovefemboys , bomboclatwallahi , and imillegal point to a teenage operator.
Every package.json sets main: "sw.js" , but no install hooks exist. The packages are not designed to be imported as Node.js modules. They are static web assets meant to be served via a CDN or hosting provider. The sw.js file is a service worker for the Scramjet web proxy:
The service worker intercepts all fetch events on its origin, routes them through Scramjet’s proxy engine, and injects a script into every proxied HTML response. That injected script hooks window.open , anchor clicks, and form submissions to capture new-tab and relay it to the parent frame via postMessage . The window.open.__lucideIntercepted flag names the project: “Lucide Proxy,” matching the GitHub repository URL github[.]com/lucideproxy/svg .
The HTML pages masquerade as legitimate tutoring businesses. The v1.1.3 wave uses “Northstar Tutoring” branding; the v1.1.2/v1.1.7 waves use “Riverbend Tutoring.” Both claim to serve Portland, Oregon. The visible content is a loading page:
A hidden block stuffs 800+ words of SEO keyword text tutoring services, test prep, and study habits. engines index it; users never see it. The og:url metadata points to hxxps://21baseballacademy[.]com , linking the fake tutoring site to the ad infrastructure.
The index.html loads three monetization layers:
1. Popunder ad (inline script):
On the first user interaction (click, keypress, or touch), this opens hxxps://abdct[.]com/ in a new tab and refocuses the original window. It rate-limits itself to once every 15 minutes using localStorage . The use of capture-phase event listeners ensures the popunder fires before any other handler can prevent it.
2. External ad script:
This domain serves additional monetization JavaScript. At the time of analysis, the endpoint returned an empty response.
3. Monetization script in the main bundle (v1.1.3 generation):
The woofbeginner[.]com domain loads additional ad scripts with a monetization key parameter. At analysis time, this endpoint returned a 500 error.
4. Google Analytics tracking:
All 141 packages report user activity to the same Google Analytics property.
The v1.1.3 wave (May 7) shipped readable source. Waves 2 and 3 ran the React application code through a hex variable name obfuscator, randomized file names (e.g., a3g0q43tbe.js , 73sxysj46r.js ), and replaced all identifiers with _0x prefixed hex patterns:
The obfuscator builds a shuffled string array, then resolves literals at runtime through a rotation function and index-offset lookups. Directory names also changed: the Scramjet runtime moved from runtime/scramjet/ to 8cfc2/ , baremux from runtime/baremux/ to d1g0y/ .
The service worker ( sw.js ) and index.html stayed readable across all waves. The popunder code, external script URLs, and analytics IDs sit in plain text.
The application uses Discord OAuth for user authentication. A .well-known/discord file in the v1.1.2/v1.1.7 packages contains the verification hash bb7ce9f4c508bc87f13889c18031ca42ad8c1bd5 . The React bundle includes a Discord sign-in flow that sends verification codes to users via Discord DM.
The AI branding SVGs in branding/ (Anthropic, OpenAI, DeepSeek, xAI, Gemini, Lucide) and a Roblox shortcut SVG suggest the proxy targets students who want to access AI chatbots and gaming sites from school networks.
These packages do not steal credentials, install backdoors, or compromise build pipelines. They abuse npm as free static hosting for an ad-monetized web proxy targeting students. Anyone who lands on these pages through results or shared links gets popunder ads, third-party tracking, and a service worker that intercepts all their proxied web traffic.
The auto-publish.sh script left in the tarball, the juvenile package names, and the “TY WAVES + CHATGPT ILY” in the service worker point to a young operator monetizing a Scramjet-based proxy unblocker through ad fraud. One account published 116 packages in under 35 minutes. npm had no rate limit to stop it.
Follow for the latest updates and insights on open source security & engineering
Four @asyncapi npm packages were published with obfuscated malware on July 14, 2026 via compromised CI workflows. The payload downloads Miasma RAT, a credential stealer targeting browsers, SSH keys,...
nodemon-sudo copies the real nodemon byte for byte, adds nothing malicious to its own code, and injects one extra dependency, tslint-conf, a repackaged pino logger carrying a backdoor. There is no...
The official jscrambler npm package (60K monthly downloads) was trojanized starting at 8.14.0 through an npm account or CI compromise. The attacker republished the same Rust infostealer across five...
On July 1, 2026, npm user marketfront batch-published 25 packages carrying the same README lure SafeDep has tracked across four earlier accounts (mr.4nd3r50n, pik-libs, t-in-one, emcd-vue): "Internal...
Start free with open source tools on your machine. Scale to a unified platform for your organization.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
