"These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload," OpenSourceMalware researcher Paul McCarty said.
How nearly 800 npm packages become a cross‑platform delivery chain
Security researchers have identified a cluster of nearly 800 malicious packages published to the npm registry that, together, deliver a cross‑platform remote access trojan (RAT) and infostealer. Rather than relying on preinstall or postinstall lifecycle hooks that many supply‑chain attacks use, the packages include READMEs that instruct developers to load them with Node's require() call; that import path triggers a downloader the researchers call WEL1DROPPER.
WEL1DROPPER: Cloudflare Workers first, DNS TXT fallback next
The downloader first identifies the host operating system and processor architecture and requests a compatible payload from one of three Cloudflare Workers domains:
- oob-worker.cf103-070.workers[.]dev
- oob-worker.cf102-baf.workers[.]dev
- oob-worker.cf99-9b3.workers[.]dev
If HTTPS-based downloads fail, the malware switches to platform‑specific domains that use DNS TXT records to deliver the next stage from "wel1[.]ru." The researchers mapped payload hosts by platform and architecture:
- Linux x64 - sdk.dl.wel1[.]ru
- Linux ARM64 - ext.dl.wel1[.]ru
- macOS - pkg.dl.wel1[.]ru
- Windows - net.dl.wel1[.]ru
The package requests a TXT record from c.<domain>, parses the response as the number of payload chunks (accepting 1–2,000), then requests numbered TXT records. The returned strings are concatenated and Base64‑decoded into a binary buffer, written to a temporary folder, and executed via "/bin/sh" on Linux/macOS or "cmd.exe" on Windows.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePlatform behavior: persistence, evasion, and second‑stage tooling
Sonatype, tracking the campaign as "Flooding Dropper," observes that the final stage is launched as a detached process. The Windows variant patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to hinder monitoring, probes for sandboxes and virtual environments, and establishes persistence via a Registry Run key and a scheduled task. It downloads an encrypted payload at "/pkg/update_win.exe" and executes it.
The macOS chain performs similar anti‑analysis checks for debuggers and artifacts, attempts to retrieve "/pkg/beacon_mac.bin" from a remote server, and if that fails, employs the DNS TXT delivery method before persisting with a LaunchAgent and starting the payload detached.
The Linux sample identified is an UPX‑packed ELF binary configured to fetch auxiliary payloads from a Cloudflare Worker URL (oob-worker[.]cf99-9b3.workers[.]dev), ultimately leading to deployment of Sliver, an open‑source command‑and‑control framework.
Decoys, possible targeting, and ties to earlier dependency confusion activity
Many of the malicious packages contain a file named "lib/telemetry.js" that implements a plausible telemetry SDK but also houses the same downloader logic. OpenSourceMalware notes the package entry point does not import that file; the oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics during a quick review.
Elements inside the macOS payload reference domains such as "tcsbank[.]ru" and "cloudpayments[.]ru," which the researchers say indicates the campaign could be targeting Russian financial institutions and mobile payments. The cluster is also suspected to be an evolution of an April dependency confusion campaign codenamed Moika, which published over 250 packages to npm to steal environment information and deliver OS‑specific second stages.
Related activity: multiple repository campaigns and weaponized browser extensions
Palo Alto Networks Unit 42 documented several other campaigns aimed at npm and PyPI. Those include a set of 10 npm packages that download an obfuscated cryptocurrency stealer and a RAT, with the packages exporting a "getPlugin" function that constructs the download URL from obfuscated code. Unit 42 also described malicious packages across npm and PyPI delivering cloud credential exfiltration, EtherHiding blockchain‑based C2 droppers, Solana wallet key theft via Telegram, .env file secret exfiltration, fake‑CAPTCHA remote code execution, Discord token theft, and GitHub Actions credential exfiltration.
Separately, Unit 42 observed Google Chrome extensions marketed as emulators, password managers, and productivity tools embedding a commercial web bandwidth‑sharing SDK that turns the browser into a crawling proxy. The SDK connects browsers to a third‑party residential proxy network, injects hidden iframes into active tabs, converts content to Markdown, and sends it to a cloud backend. Some extensions disclose the behavior and call it an opt‑in; Unit 42 cites InstaSkip (mdondgockboebafloibbhjofmoedmnnn) as a notable example where the opt‑in is framed as necessary for uninterrupted service.
What this means for technologists, npm maintainers, and enterprise defenders
- Technologists and security teams should watch for packages that require() unexpectedly, audit package entry points and ancillary files such as lib/telemetry.js, and monitor for the execution patterns described here (Cloudflare Worker downloads, fallback to DNS TXT chunking, /bin/sh or cmd.exe execution).
- npm maintainers and repository operators should be alert to high‑volume clusters of typo‑squatted or randomly generated names and the use of packing or decoy telemetry code intended to confuse cursory review.
- Enterprise defenders and incident responders should look for indicators described by Sonatype—ETW/AMSI tampering on Windows, Registry Run key and scheduled task persistence, LaunchAgent creation on macOS, UPX‑packed ELF activity on Linux, and Sliver C2 indicators—and consider blocking the listed Cloudflare Workers domains and the wel1[.]ru delivery hosts.
Nearly 800 packages delivering a single, multi‑platform delivery chain is a marked escalation in scale and sophistication: the campaign combines simple social engineering (require() instructions and decoy telemetry), resilient delivery (Cloudflare Workers plus DNS TXT chunking), and platform‑specific evasion and persistence. Whether repository operators and defenders can remove or neutralize this cluster before operators turn the deployed RAT and infostealer loose at scale remains the immediate question.
Original reporting: https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html
