Nearly 800 Malicious npm Packages Deliver Cross-Platform RATs and Infostealers

Software supply chain attackers have published a cluster of nearly 800 malicious packages to the official npm registry, targeting Windows, macOS, and Linux environments. The campaign leverages automatically generated or AI-slop typosquatted package names to trick developers into integrating malicious dependencies. Instead of relying on traditional build-time lifecycle hooks such as preinstall or postinstall—which automated supply chain scanners frequently flag—the threat actor distributes code that relies on developers explicitly importing the module using Node.js require() statements.

The malicious packages also ship with a dummy file named lib/telemetry.js that mimics a legitimate profiling or analytics SDK. While not directly executed by the primary package entry point, this inflated telemetry implementation serves as anti-analysis noise, designed to obscure the underlying attack logic during quick manual code reviews.

The WEL1DROPPER Execution Chain

When an affected package is imported into a Node.js project, it triggers a lightweight downloader known as WEL1DROPPER. Upon execution, the dropper queries the host machine to identify its operating system and CPU architecture (such as x86_64 or ARM). It then attempts to fetch a matched second-stage binary payload from one of several Cloudflare Workers domains.

If HTTP/HTTPS outbound traffic to the primary Cloudflare infrastructure fails or is intercepted by network controls, WEL1DROPPER switches to an evasive DNS-based fallback channel. It issues DNS TXT queries to subdomains under wel1[.]ru. The process operates as follows:

1. The malware requests a TXT record from c.wel1[.]ru.
2. The returned record specifies the total number of payload chunks to assemble (ranging anywhere from 1 to 2,000 chunks).
3. The dropper iteratively requests sequential numbered TXT records (e.g., 1.wel1[.]ru, 2.wel1[.]ru).
4. The retrieved strings are concatenated in memory and Base64-decoded into a binary executable buffer.

This DNS tunneling technique allows the malware to bypass traditional web proxies, domain blocklists, and inspection gateways that do not closely inspect TXT record responses. Once reconstructed in a temporary system directory, the binary is launched via /bin/sh on Unix-like operating systems or cmd.exe on Windows.

OS-Specific Payload Delivery and Persistence

Research into the campaign—tracked by security firms as Flooding Dropper—shows tailored post-exploitation behavior depending on the victim’s operating system:

• Windows: The Windows executable actively attempts to evade host security tooling by patching userland hooks for Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) in memory. It performs checks for virtual machines, debuggers, and sandbox artifacts before establishing persistence using Registry Run keys and Scheduled Tasks. Finally, it downloads and executes an encrypted binary payload located at /pkg/update_win.exe.
• macOS: The macOS variant conducts similar anti-analysis checks before retrieving /pkg/beacon_mac.bin from remote infrastructure. If web fetching fails, it falls back to the DNS TXT reassembly method. Persistence on macOS systems is established by creating a persistent LaunchAgent plist file before spawning the payload in a detached process. Hardcoded string references within the macOS payload include domains such as tcsbank[.]ru and cloudpayments[.]ru, indicating potential targeting of Russian financial and payment ecosystems.
• Linux: The Linux variant consists of a UPX-packed ELF executable. It connects to a Cloudflare Worker staging URL (oob-worker[.]cf99-9b3.workers[.]dev) to pull auxiliary components, ultimately deploying the open-source C2 framework Sliver to grant the adversary full interactive remote access.

Wider Ecosystem Threats and Lineage

This mass-publishing effort represents an evolution of the “Moika” dependency confusion campaign observed earlier this year, which involved over 250 npm packages harvesting environment secrets and dropping OS-specific binaries.

The threat landscape surrounding open-source repositories continues to expand beyond simple credential harvesters. Parallel security investigations have identified concurrent campaigns across npm and PyPI:

• Obfuscated Cryptocurrency Stealers: Packages exporting a getPlugin function that dynamically constructs download URLs via obfuscated Immediately Invoked Function Expressions (IIFEs) hidden inside JSON structures.
• Multi-Vector Ecosystem Attacks: Packages designed for cloud credential exfiltration, Solana crypto wallet key theft via Telegram bots, .env file harvesting, fake CAPTCHA social engineering executing remote commands, and CI/CD credential theft targeting GitHub Actions secrets.
• Malicious Chrome Extensions: Malicious actors are also targeting developer workflows through browser extensions (such as InstaSkip, ID mdondgockboebafloibbhjofmoedmnnn). Nominally advertised as utility or productivity tools, these extensions embed background residential proxy SDKs that convert infected web browsers into unauthorized scrapers and web-crawling nodes using hidden iframe injections and WebSocket connections.

Recommended Mitigations and Detection Strategy

Organizations utilizing Node.js environments should take immediate steps to audit their software dependency trees and network activity:

1. Package Verification: Audit software supply chains for unrecognized packages utilizing typosquatted variations of popular libraries. Utilize Software Bill of Materials (SBOM) tools and lockfiles (package-lock.json, yarn.lock) to enforce strict dependency hashing.
2. Network Level Indicators: Block and alert on outbound DNS TXT requests resolving against wel1[.]ru subdomains, as well as traffic directed to oob-worker[.]cf99-9b3.workers[.]dev or related Cloudflare Worker staging endpoints.
3. Endpoint Monitoring: Configure EDR solutions to flag suspicious process creation originating from Node.js binaries (node.exe or node) spawning cmd.exe or /bin/sh executing binaries from %TEMP% or /tmp directories. On Windows hosts, monitor for in-memory patching of amsi.dll and ntdll.dll (ETW functions), alongside unauthorized additions to HKCU\Software\Microsoft\Windows\CurrentVersion\Run. On macOS, alert on unverified LaunchAgent creations in ~/Library/LaunchAgents/.