A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed ...