A supply chain campaign has flooded npm with nearly 800 malicious packages that install a cross-platform RAT and infostealer on Windows, Mac, and Linux machines. OpenSourceMalware researcher Paul McCarty says the packages use AI-slop-style randomly generated typosquat names, and instead of relying on lifecycle hooks, they ship a README that urges developers to run the code.
The infection chain leans on DNS. Next-stage payloads are fetched from platform-specific domains under wel1[.]ru, with DNS TXT records parceling the download into chunks that are base64-decoded into a binary and run through /bin/sh on Linux and macOS or cmd.exe on Windows.
Each operating system gets a tailored implant. Windows builds patch ETW and AMSI, probe for sandboxes, persist via a Registry Run key plus a scheduled task, and pull an encrypted update. macOS variants hunt for debuggers, drop a LaunchAgent, and run a beacon binary. The Linux payload is a UPX-packed ELF that grabs auxiliary files from a Cloudflare Worker URL and deploys Sliver, the open-source C2 framework.
A decoy telemetry file adds review noise, while tcsbank[.]ru and cloudpayments[.]ru references in the macOS payload hint at Russian financial targets. Sonatype, tracking the same activity as Flooding Dropper, counts 850 packages, and researchers believe the campaign grew out of the April Moika dependency-confusion wave.
