148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet