Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign) — Threadlinqs Intelligence
As of 2026-08-07, Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign) is a high-severity supply chain threat attributed to Unknown ("Flooding Dropper" operator (Russia (suspected, unconfirmed)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1935 · Severity: HIGH · CVSS: 8.7 · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Unknown ("Flooding Dropper" operator · Russia (suspected, unconfirmed) · FINANCIAL
A suspected Russian-speaking threat actor published roughly 800-846 AI-slopsquatted npm packages (tracked by Sonatype as 'Flooding Dropper', sonatype-2026-005660, and by OpenSourceMalware as the
Beginning around early August 2026, an automated npm-publishing operation flooded the registry with close to 850 malicious packages built around interpolated keyword pairs such as 'bigops' and 'bnpl' (e.g. bigops-backend, bigops-api, dolyame-boxy-desktop-bnpl-card-gallery), clustering releases in a recurring 35.x.y version range. Rather than relying on npm lifecycle hooks (preinstall/postinstall), the packages instruct developers via README text to load the malicious functionality through a plain require() call, sidestepping install-time scanning that focuses on lifecycle scripts. The loaded JavaScript (index.js / _helpers.js) fingerprints the host OS and CPU architecture and retrieves a platform-specific binary either over HTTPS from a rotating set of Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and a package-proxy.cf5oobworker.workers.dev through cf11oobworker.workers.dev pool) or, if that fails, by reassembling the payload from base64-encoded DNS TXT records served from wel1[.]ru subdomains (sdk.dl., ext.dl., pkg.dl., net.dl.). A companion file, lib/telemetry.js, mimics a legitimate analytics SDK to add plausibility during manual code review.
The delivered second stage, dubbed WEL1DROPPER by OpenSourceMalware (referenced once in its own reporting as 'NUL1DROPPER'), performs OS-specific defense evasion before fetching the final payload: on Windows it patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI), detects debuggers/VMs/sandboxes, and persists via Registry Run keys and scheduled tasks before pulling an encrypted update_win.exe that is reflectively loaded into memory. On macOS it detects analysis tooling (lldb, debugserver, dtrace, frida) and VMware artifacts, XOR-obfuscates (single-byte key 0x9c) its embedded infrastructure strings, persists via a LaunchAgent disguised as com.apple.windowserver.helper.plist, and downloads beacon_mac.bin. On Linux, a UPX-packed statically-linked ELF deploys an implant that researchers identified as Sliver, the open-source Bishop Fox command-and-control framework. All platforms write payloads to innocuous-looking paths (/var/tmp/.cache_<8hex>, %TEMP%\dotnet_diag_<8hex>.exe) and use a local marker file to rate-limit re-execution to roughly once every six hours (21,760 seconds).
Secondary infrastructure embedded in the macOS payload references three Russian financial-sector hostnames (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), and the use of the .ru wel1[.]ru domain for DNS-based payload delivery led OpenSourceMalware to assess the operator as likely Russian-speaking. The same researchers link this campaign's tradecraft — 'oob' infrastructure nomenclature, Russian financial-institution impersonation, and fake-telemetry camouflage — to the earlier 2026 'Moika' dependency-confusion campaign (npm accounts mr.4nd3r50n, pik-libs, t-in-one, and the @emcd-vue scope; 250+ packages impersonating SberPay and the EMCD crypto exchange), suggesting the same operator has evolved from dependency confusion to README-triggered require() social engineering at greater scale. Sonatype independently opened tracking as sonatype-2026-005660, assigning CVSS 8.7 under CWE-506 (Embedded Malicious Code) and counting 846 affected components at time of publication; no CVE has been assigned since this is malicious third-party content rather than a vulnerability in legitimate software.
Target sectors: technology, finance, softwaredevelopment
Target regions: Global, russia
Timeline
- Precursor 'Moika' dependency-confusion campaign Wave 1: npm accounts mr.4nd3r50n and pik-libs publish 164 packages across five internal scopes at version 99.99.99, establishing the 'oob' infrastructure naming and Russian-financial-sector targeting later reused in Flooding Dropper.
- Moika Wave 2: npm account t-in-one publishes 12 packages impersonating Sberbank's SberPay payment SDK.
- Moika Wave 3: the @emcd-vue scope impersonates EMCD, a Russian cryptocurrency exchange, continuing the operator's Russian-financial-sector lure pattern; SafeDep documents 260+ threat reports tied to oob.moika.tech infrastructure.
- OpenSourceMalware researcher Paul McCarty reports the first malicious package, bigops-backend, delivering a platform-specific binary dropper to Windows, Linux, and macOS installers.
- Sonatype Research Labs opens tracking as sonatype-2026-005660 ('Flooding Dropper'), assigns CVSS 8.7 under CWE-506, and counts 846 malicious npm components using 'bigops'/'bnpl' keyword interpolation and 35.x.y version releases.
- OpenSourceMalware publishes a deep-dive identifying the WEL1DROPPER downloader, DNS TXT-record payload-reconstruction technique, wel1[.]ru and Cloudflare Workers C2 infrastructure, and a Sliver C2 implant final stage; tracked package count reaches 788 over 48 hours.
- The Hacker News publishes coverage of the campaign, reporting nearly 800 malicious npm packages delivering the cross-platform WEL1DROPPER RAT and infostealer.
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1608.001, T1587.001, T1583.001, T1583.006, T1195.001, T1059.007, T1204.002, T1547.001, T1053.005, T1543.001
