141 npm packages as adware hosting (terminal3airport)

SafeDep: npm account terminal3airport published 141 packages containing
a web proxy unblocker disguised as tutoring websites, loading pop-under
adware. Abuse of the registry as a CDN, not a targeted ATO.

Mapped techniques

T0109 Publish malicious artifact
T0110 Advertise malicious artifact

supply-chain registry as cdn

T0109 · Resource Development · Publish malicious artifact

141 packages from one account.

T0110 · Resource Development · Advertise malicious artifact

Tutoring-site disguise.

Sources

https://safedep.io/malicious-npm-terminal3airport-proxy-adware-spam