Nearly 800 npm packages spread cross-platform RAT and infostealer
Nearly 800 malicious packages were published to the npm registry in a campaign delivering remote-access trojans and information stealers to Windows, macOS and Linux systems. OpenSourceMalware researcher Paul McCarty said the packages use AI-generated, squatted or randomly generated typo-squatting names and carry a cross-platform payload.
The campaign differs from many npm supply-chain attacks because it does not principally depend on preinstall or postinstall lifecycle hooks. Instead, the packages include README instructions telling developers to load them with require(), the built-in Node.js function for importing modules, local files and third-party packages.
Downloader selects a payload for the host
Loading a package initiates WEL1DROPPER, a downloader that identifies the operating system and processor architecture before fetching a compatible payload from one of three Cloudflare Workers hosts. The campaign uses separate delivery domains for Linux x64, Linux ARM64, macOS and Windows.
If an HTTPS download fails, the malware falls back to a platform-specific domain and retrieves its next stage through DNS TXT records from wel1.ru. McCarty said the code first requests a TXT record that states the number of payload chunks, accepting values from 1 to 2,000. It then requests numbered TXT records, joins their contents and Base64-decodes them into a binary buffer.
The resulting payload is written to a temporary folder and executed with /bin/sh on Linux and macOS or cmd.exe on Windows. The large package cluster shows how borrowed trust in software supply chains can turn an apparently routine dependency into an initial access path, as borrowed trust in software supply chains examines in the broader security landscape.
Flooding Dropper adds persistence and evasion
Sonatype, which tracks the campaign as Flooding Dropper, reported that the final stage runs as a detached process. On Windows, it can patch Event Tracing for Windows and the Antimalware Scan Interface, check for sandboxes and virtual environments, create persistence through a Registry Run key and a scheduled task, then download and run an encrypted payload named /pkg/update_win.exe.
The macOS chain similarly checks for debuggers and analysis artifacts, retrieves /pkg/beacon_mac.bin, uses DNS TXT delivery when needed and sets persistence through a LaunchAgent. The Linux sample is a UPX-packed ELF binary that downloads auxiliary payloads from a Cloudflare Worker and ultimately deploys Sliver, an open-source command-and-control framework.
Review signals beyond the entry point
The packages also contain lib/telemetry.js, a plausible-looking telemetry SDK with the same downloader logic. OpenSourceMalware said the entry point does not import that file and that it contains no additional hard-coded infrastructure, suggesting the oversized implementation was intended to add noise during a quick review.
For businesses using npm, unfamiliar dependencies should be assessed before they enter builds: scrutinise package names and README-driven execution instructions, inspect files beyond the declared entry point, and test new components in controlled environments. Those checks are particularly relevant where a package can select a host-specific payload and establish persistence after a developer imports it.