Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign)

Key facts for WEL1DROPPER npm supply chain

Detection coverage for WEL1DROPPER npm supply chain

As of 2026-08-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1935 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Windows ETW/AMSI Tamper Preceding Persistence via Run Key or Scheduled Task

Detects the WEL1DROPPER Windows post-exploitation chain: ETW provider unhooking or AMSI.dll patching (via memory patch/API-hook indicators) followed by creation of a Registry Run key or Scheduled Task referencing the disguised staging path %TEMP%\dotnet_diag_<8hex>.exe, ahead of the reflectively-loaded update_win.exe final payload.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1685, T1547.001, T1053.005, T1622, T1497.001
• Data sources: sysmon, windows_security, edr_registry_events, edr_process_events
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon (EventCode=7 AND (ImageLoaded="*amsi.dll" OR ImageLoaded="*\\combase.dll"))
| eval evasion_time=_time
| join type=inner Computer [
    search index=sysmon (EventCode=13 OR EventCode=1) earliest=-10m
    ( (EventCode=13 AND TargetObject="*\\CurrentVersion\\Run\\*" AND Details="*dotnet_diag_*")
      OR (EventCode=1 AND CommandLine="*schtasks*" AND CommandLine="*dotnet_diag_*") )
    | rename _time as persist_time
    | fields Computer, TargetObject, Details, CommandLine, persist_time
  ]
| where persist_time >= evasion_time AND persist_time <= evasion_time + 600
| table evasion_time, persist_time, Computer, ImageLoaded, TargetObject, Details, CommandLine
| sort -persist_time

Microsoft KQL

let evasion = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "AmsiProviderLoaded" or (ActionType == "ProcessCreated" and AdditionalFields has "NtSetInformationThread");
let persistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueData has "dotnet_diag_";
evasion
| join kind=inner (persistence) on DeviceId
| where persistence.Timestamp - evasion.Timestamp between (0min .. 10min)
| project EvasionTime = evasion.Timestamp, PersistTime = persistence.Timestamp, DeviceName = evasion.DeviceName, RegistryKey = persistence.RegistryKey, RegistryValueData = persistence.RegistryValueData
| order by PersistTime desc

Sigma

title: AMSI/ETW Tamper Followed by dotnet_diag_ Persistence (WEL1DROPPER)
id: 1a2b3c4d-7e8f-4901-b2c3-d4e5f6a7b8c9
status: experimental
description: Detects AMSI/ETW defense-impairment activity closely followed by Registry Run key or Scheduled Task persistence referencing the WEL1DROPPER disguised staging filename pattern dotnet_diag_<8hex>.exe.
references:
  - https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-07
tags:
  - attack.defense-evasion
  - attack.t1685
  - attack.persistence
  - attack.t1547.001
  - attack.t1053.005
  - attack.malware.wel1dropper
logsource:
  category: registry_event
  product: windows
detection:
  selection_persist:
    TargetObject|contains: 'CurrentVersion\Run'
    Details|contains: 'dotnet_diag_'
  selection_task:
    CommandLine|contains:
      - 'schtasks'
      - 'dotnet_diag_'
  condition: selection_persist or selection_task
falsepositives:
  - Legitimate .NET diagnostics tooling that happens to use a similarly-named temp file unrelated to the campaign (rare given the random 8-hex suffix)
level: critical

Known false positives:

• Legitimate security or diagnostics agents that load amsi.dll for benign scanning purposes coinciding by chance with unrelated Run-key creation

Tuning notes: Add the exact dotnet_diag_ 8-hex-suffix regex to the persistence selector to sharpen precision; correlate with the marker-file rate-limit behavior (~21,760s re-execution interval) for additional confidence scoring.

• 🔒 Platform-Specific WEL1DROPPER Payload Fetch Following Node Process Fingerprinting · unlock with TL Creds
• 🔒 Suspicious Reflective In-Memory Load of [indicator] After AMSI/ETW Impairment · unlock with TL Creds
• 🔒 Sliver C2 Beacon Callback and Local Health-Check Port on Linux Hosts · unlock with TL Creds
• 🔒 Malicious npm Package Name/Version Pattern Install (bigops/bnpl Keyword Interpolation) · unlock with TL Creds
• 🔒 macOS/Linux WEL1DROPPER Persistence via Disguised LaunchAgent or Cache Staging Path · unlock with TL Creds
• 🔒 Rate-Limited Re-Execution Marker File Consistent With WEL1DROPPER C2 Cadence · unlock with TL Creds
• 🔒 npm require() Downloader First-Contact Callout to Flooding Dropper Infrastructure · unlock with TL Creds
• 🔒 DNS TXT-Record Payload Reassembly Against [indicator] C2 Infrastructure · unlock with TL Creds

Indicators of compromise for WEL1DROPPER npm supply chain

As of 2026-08-07, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-1935.

Sample indicators (3 of 30)

• Domain: oob-worker[.]cf103-070[.]workers[.]dev
• File hash: 7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3
• Domain: oob-worker[.]cf102-baf[.]workers[.]dev

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How WEL1DROPPER npm supply chain works

Beginning around early August 2026, an automated npm-publishing operation flooded the registry with close to 850 malicious packages built around interpolated keyword pairs such as 'bigops' and 'bnpl' (e.g. bigops-backend, bigops-api, dolyame-boxy-desktop-bnpl-card-gallery), clustering releases in a recurring 35.x.y version range. Rather than relying on npm lifecycle hooks (preinstall/postinstall), the packages instruct developers via README text to load the malicious functionality through a plain require() call, sidestepping install-time scanning that focuses on lifecycle scripts. The loaded JavaScript (index.js / _helpers.js) fingerprints the host OS and CPU architecture and retrieves a platform-specific binary either over HTTPS from a rotating set of Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and a package-proxy.cf5oobworker.workers.dev through cf11oobworker.workers.dev pool) or, if that fails, by reassembling the payload from base64-encoded DNS TXT records served from wel1[.]ru subdomains (sdk.dl., ext.dl., pkg.dl., net.dl.). A companion file, lib/telemetry.js, mimics a legitimate analytics SDK to add plausibility during manual code review.

The delivered second stage, dubbed WEL1DROPPER by OpenSourceMalware (referenced once in its own reporting as 'NUL1DROPPER'), performs OS-specific defense evasion before fetching the final payload: on Windows it patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI), detects debuggers/VMs/sandboxes, and persists via Registry Run keys and scheduled tasks before pulling an encrypted update_win.exe that is reflectively loaded into memory. On macOS it detects analysis tooling (lldb, debugserver, dtrace, frida) and VMware artifacts, XOR-obfuscates (single-byte key 0x9c) its embedded infrastructure strings, persists via a LaunchAgent disguised as com.apple.windowserver.helper.plist, and downloads beacon_mac.bin. On Linux, a UPX-packed statically-linked ELF deploys an implant that researchers identified as Sliver, the open-source Bishop Fox command-and-control framework. All platforms write payloads to innocuous-looking paths (/var/tmp/.cache_<8hex>, %TEMP%\dotnet_diag_<8hex>.exe) and use a local marker file to rate-limit re-execution to roughly once every six hours (21,760 seconds).

Secondary infrastructure embedded in the macOS payload references three Russian financial-sector hostnames (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), and the use of the .ru wel1[.]ru domain for DNS-based payload delivery led OpenSourceMalware to assess the operator as likely Russian-speaking. The same researchers link this campaign's tradecraft — 'oob' infrastructure nomenclature, Russian financial-institution impersonation, and fake-telemetry camouflage — to the earlier 2026 'Moika' dependency-confusion campaign (npm accounts mr.4nd3r50n, pik-libs, t-in-one, and the @emcd-vue scope; 250+ packages impersonating SberPay and the EMCD crypto exchange), suggesting the same operator has evolved from dependency confusion to README-triggered require() social engineering at greater scale. Sonatype independently opened tracking as sonatype-2026-005660, assigning CVSS 8.7 under CWE-506 (Embedded Malicious Code) and counting 846 affected components at time of publication; no CVE has been assigned since this is malicious third-party content rather than a vulnerability in legitimate software.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1620 Reflective Code Loading; T1622 Debugger Evasion

Persistence

T1053.005 Scheduled Task; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.004 DNS

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1587.001 Malware; T1608.001 Upload Malware

defense-impairment

T1685 Disable or Modify Tools

Remediation for WEL1DROPPER npm supply chain

Patches

• Not applicable — this is malicious third-party package content, not a vulnerability in legitimate software; remediation is package removal, not patching

Immediate actions

• Treat any host that installed one of the ~846 affected packages as compromised: isolate it from the network before further investigation
• Remove the malicious package(s) and purge related version releases (35.x.y pattern, 'bigops'/'bnpl' keyword families) from lockfiles, npm caches, internal registries/mirrors, and container image layers
• Block egress to *.wel1.ru, wel1.ru, oob-worker.cf*.workers.dev, and package-proxy.cf*oobworker.workers.dev, and hunt for outbound connections to those hosts in proxy/DNS logs
• Search endpoint telemetry for the persistence artifacts: Windows Registry Run keys / scheduled tasks pointing at %TEMP%\dotnet_diag_*.exe, macOS ~/Library/LaunchAgents/com.apple.windowserver.helper.plist, and Linux/macOS processes launched from /var/tmp/.cache_*

Workarounds

• Never load package functionality via undocumented require() instructions found only in a README rather than the package's documented entrypoint
• Verify package names character-by-character against the legitimate package before installing, and avoid packages with only recently-created, low-reputation publisher accounts
• Rotate npm, cloud, and CI/CD credentials on any host that installed an affected package, only after the environment has been cleaned

Longer-term hardening

• Deploy a package-firewall / install-time allowlist (e.g. Sonatype, Socket, npm audit signals) that flags newly-published or unreviewed packages before they reach developer or CI/CD machines
• Monitor for anomalous DNS TXT-record query patterns (queries of the form c.<domain> followed by sequential <integer>.<domain> lookups) as a detection signal for DNS-based payload staging
• Prioritize behavioral detection (require()-triggered network calls, reflective in-memory execution, ETW/AMSI tampering) over static IOC matching, since the operator rotates package names and infrastructure quickly

Affected and fixed versions

• npm, Inc. (npm public registry) — Third-party npm packages using 'bigops'/'bnpl' keyword interpolation and 35.x.y version releases (e.g. bigops-backend, bigops-api, dolyame-boxy-desktop-bnpl-card-gallery)
  Vulnerable versions: All ~846 malicious package releases identified in the campaign, clustered in the 35.x.y version range
  Fixed in: Malicious packages removed from the npm registry following disclosure by OpenSourceMalware and Sonatype (no upstream software patch applies)

Timeline of WEL1DROPPER npm supply chain

• 2026-05-27 Precursor 'Moika' dependency-confusion campaign Wave 1: npm accounts mr.4nd3r50n and pik-libs publish 164 packages across five internal scopes at version 99.99.99, establishing the 'oob' infrastructure naming and Russian-financial-sector targeting later reused in Flooding Dropper.
• 2026-05-29 Moika Wave 2: npm account t-in-one publishes 12 packages impersonating Sberbank's SberPay payment SDK.
• 2026-06-01 Moika Wave 3: the @emcd-vue scope impersonates EMCD, a Russian cryptocurrency exchange, continuing the operator's Russian-financial-sector lure pattern; SafeDep documents 260+ threat reports tied to oob.moika.tech infrastructure.
• 2026-08-05 Sonatype Research Labs opens tracking as sonatype-2026-005660 ('Flooding Dropper'), assigns CVSS 8.7 under CWE-506, and counts 846 malicious npm components using 'bigops'/'bnpl' keyword interpolation and 35.x.y version releases.
• 2026-08-05 OpenSourceMalware researcher Paul McCarty reports the first malicious package, locked-ioc-25, delivering a platform-specific binary dropper to Windows, Linux, and macOS installers.
• 2026-08-06 OpenSourceMalware publishes a deep-dive identifying the locked-ioc-26 downloader, DNS TXT-record payload-reconstruction technique, locked-ioc-29 and Cloudflare Workers C2 infrastructure, and a locked-ioc-30 C2 implant final stage; tracked package count reaches 788 over 48 hours.
• 2026-08-07 The Hacker News publishes coverage of the campaign, reporting nearly 800 malicious npm packages delivering the cross-platform locked-ioc-26 RAT and infostealer.

Sources cited for WEL1DROPPER npm supply chain

• MAL-2026-5041 (Moika campaign malicious package advisory) osv.dev · Advisory · 2026-06-01
• 'Flooding Dropper' Campaign Hits npm With Nearly 850 Malicious Packages sonatype.com · Vendor report · 2026-08-05
• Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages opensourcemalware.com · Research · 2026-08-06
• 183 npm Packages Target Cloud and Finance via oob.moika.tech safedep.io · Research · 2026-06-01
• The npm Threat Landscape: Attack Surface and Mitigations Unit 42 · Vendor report · 2026-07-15
• Flooding Dropper Hits npm With 850 Malicious Packages securityboulevard.com · Blog · 2026-08-06
• Flooding Dropper Hits npm With 850 Malicious Packages (syndicated) malware.news · Blog · 2026-08-06
• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer The Hacker News · News · 2026-08-07

Threats related to WEL1DROPPER npm supply chain

• Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper")
• TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bank

Previous and next in supply chain

• AI Recommendation Poisoning: Prompt Injection via Deep-Linked 'Ask AI' Buttons Silently Alters LLM Memory Previous report
• FirewallFalcon Manager: Supply-Chain Backdoor in Underground VPN Server Infrastructure Next report

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• npm Supply Chain Attacks 2026: 218 Packages