Coordinated wave of 148 disposable npm packages published for malicious purposes. Each package embeds a remotely updatable code-execution hook and a WebSocket-based traffic generator that turns any browser importing the package into a node for distributed denial-of-service floods. The package names are throwaway and impersonation-style (abuden*, ishowfeet*, nottuff*, ratelimitsucks*, sixseven*, speed*, and others) with no legitimate functionality, indicating intentional abuse of the registry rather than a compromised maintainer.