The npm registry just absorbed a cluster of nearly 800 malicious packages, each carrying the same cross-platform payload. Researcher Paul McCarty at OpenSourceMalware describes the load as a RAT and infostealer combo targeting Windows, Mac, and Linux machines, with package names that are randomly generated or AI slop squatted.
Instead of abusing lifecycle hooks, these packages ship a README that tells developers to load them with require(). That import triggers WEL1DROPPER, a downloader that profiles the host operating system and processor architecture, then fetches a compatible payload from Cloudflare Workers hosts.
If HTTPS downloads fail, the malware queries DNS TXT records on wel1[.]ru domains to obtain the next stage. Sonatype tracks the campaign as Flooding Dropper, counting about 850 packages. Windows samples patch ETW and AMSI, check for sandboxes, and establish persistence via a Registry Run key and scheduled task. Linux samples deploy the open-source Sliver C2 framework.
A decoy file called lib/telemetry.js mimics a telemetry SDK to muddy code review. Russian payment domains such as tcsbank[.]ru and cloudpayments[.]ru inside the macOS payload hint the campaign is aimed at Russian banks and payment apps. OpenSourceMalware links the cluster to Moika, a dependency confusion wave that flooded npm in April.
