Nearly 800 npm packages spread cross-platform RAT and infostealer
Nearly 800 malicious packages were published to the npm registry in a campaign delivering remote-access trojans and information stealers to Windows, macOS and Linux systems. OpenSourceMalware researcher Paul McCarty said the packages use AI-generated, squatted or randomly generated typo-squatting names and carry a cross-platform payload.
The campaign differs from many npm supply-chain attacks because it does not principally depend on preinstall or postinstall lifecycle hooks. Instead, the packages include README instructions telling developers to load them with require(), the built-in Node.js function for importing modules, local files and third-party packages.
Downloader selects a payload for the host
Loading a package initiates WEL1DROPPER, a downloader that identifies the operating system and processor architecture before fetching a compatible payload from one of three Cloudflare Workers hosts. The campaign uses separate delivery domains for Linux x64, Linux ARM64, macOS and Windows.
If an HTTPS download fails, the malware falls back to a platform-specific domain and retrieves its next stage through DNS TXT records from wel1.ru. McCarty said the code first requests a TXT record that states the number of payload chunks, accepting values from 1 to 2,000. It then requests numbered TXT records, joins their contents and Base64-decodes them into a binary buffer.
The resulting payload is written to a temporary folder and executed with /bin/sh on Linux and macOS or cmd.exe on Windows. The large package cluster shows how borrowed trust in software supply chains can turn an apparently routine dependency into an initial access path, as borrowed trust in software supply chains examines in the broader security landscape.
Flooding Dropper adds persistence and evasion
Sonatype, which tracks the campaign as Flooding Dropper, reported that the final stage runs as a detached process. On Windows, it can patch Event Tracing for Windows and the Antimalware Scan Interface, check for sandboxes and virtual environments, create persistence through a Registry Run key and a scheduled task, then download and run an encrypted payload named /pkg/update_win.exe.
The macOS chain similarly checks for debuggers and analysis artifacts, retrieves /pkg/beacon_mac.bin, uses DNS TXT delivery when needed and sets persistence through a LaunchAgent. The Linux sample is a UPX-packed ELF binary that downloads auxiliary payloads from a Cloudflare Worker and ultimately deploys Sliver, an open-source command-and-control framework.
Review signals beyond the entry point
The packages also contain lib/telemetry.js, a plausible-looking telemetry SDK with the same downloader logic. OpenSourceMalware said the entry point does not import that file and that it contains no additional hard-coded infrastructure, suggesting the oversized implementation was intended to add noise during a quick review.
For businesses using npm, unfamiliar dependencies should be assessed before they enter builds: scrutinise package names and README-driven execution instructions, inspect files beyond the declared entry point, and test new components in controlled environments. Those checks are particularly relevant where a package can select a host-specific payload and establish persistence after a developer imports it.
WEL1DROPPER: how the npm malware chain works
WEL1DROPPER is the downloader used in this malicious npm package campaign. Rather than relying mainly on installation hooks, affected packages instruct developers to import them with require(), which starts a platform-aware delivery chain.
From package import to platform-specific payload
After an affected package is loaded, WEL1DROPPER identifies the operating system and processor architecture. It then requests a compatible payload from campaign-controlled Cloudflare Workers infrastructure, with separate delivery paths for Windows, macOS, Linux x64 and Linux ARM64.
- Execution begins when a developer imports the affected package.
- The downloader checks the host platform before selecting a payload.
- The next stage is written to a temporary directory and executed.
Why DNS TXT traffic matters
If the HTTPS request fails, the downloader can retrieve its next stage through DNS TXT records. It first requests the expected number of chunks, downloads numbered records, joins their contents and Base64-decodes the result into a binary buffer. This fallback makes review of both web and DNS activity relevant when investigating suspected exposure.
- DNS TXT records can carry the payload in numbered chunks.
- HTTPS failure does not necessarily stop the delivery chain.
- Unexpected DNS requests from build systems warrant investigation.
Checks for npm dependency review
A package should be assessed beyond its name and declared entry point. In this campaign, README-driven execution and a plausible telemetry file containing downloader logic show why reviewers need to inspect documentation, bundled files and runtime behaviour together.
- Verify package names, publishers and expected functionality.
- Treat unusual require() instructions as a review signal.
- Inspect bundled files beyond the declared entry point.
- Test unfamiliar dependencies in a controlled environment.
Frequently asked questions
Is WEL1DROPPER a remote-access trojan?
WEL1DROPPER is described here as a downloader. It identifies the host platform and retrieves a compatible next-stage payload, which can then provide further malicious capabilities.
How does WEL1DROPPER start running?
In this campaign, malicious npm packages used README instructions that told developers to load them with require(). Importing the package initiated the downloader instead of depending principally on preinstall or postinstall hooks.
Which operating systems does WEL1DROPPER target?
The observed delivery chain selected payloads for Windows, macOS, Linux x64 and Linux ARM64 systems.
What happens if the HTTPS payload download fails?
The downloader can fall back to a platform-specific domain and retrieve payload chunks through DNS TXT records before joining and decoding them.