Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign)
Nearly 800 Malicious npm Packages Deliver Cross-Platform (TL-2026-1935), also tracked as Flooding Dropper, is a high-severity supply-chain compromise scored CVSS 8.7, first published 2026-08-07. It is linked to a Russia-nexus actor with low confidence, affects npm, Inc. (npm public registry) Third-party npm packages using, maps to 17 MITRE ATT&CK techniques (T1027.002, T1036.005, T1053.005), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-1935
- Threat ID
- TL-2026-1935
- Also known as
- Flooding Dropper, WEL1DROPPER campaign, sonatype-2026-005660
- Severity
- HIGH
- CVSS
- 8.7
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-07
- Last reviewed
- 2026-08-07
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, softwaredevelopment
- Target regions
- Global, russia
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Nearly 800 Malicious npm Packages Deliver Cross-Platform
Malware and tooling: WEL1DROPPER, Sliver - S0633
A suspected Russian-speaking threat actor published roughly 800-846 AI-slopsquatted npm packages (tracked by Sonatype as 'Flooding Dropper', sonatype-2026-005660, and by OpenSourceMalware as the WEL1DROPPER campaign) that lure developers into executing a require()-triggered downloader documented only in the package README. The downloader deploys platform-specific final payloads — a Sliver C2 implant on Linux, update_win.exe on Windows, and beacon_mac.bin on macOS — using ETW/AMSI patching, sandbox/debugger evasion, and native OS persistence.
How Nearly 800 Malicious npm Packages Deliver Cross-Platform works
Beginning around early August 2026, an automated npm-publishing operation flooded the registry with close to 850 malicious packages built around interpolated keyword pairs such as 'bigops' and 'bnpl' (e.g. bigops-backend, bigops-api, dolyame-boxy-desktop-bnpl-card-gallery), clustering releases in a recurring 35.x.y version range. Rather than relying on npm lifecycle hooks (preinstall/postinstall), the packages instruct developers via README text to load the malicious functionality through a plain require() call, sidestepping install-time scanning that focuses on lifecycle scripts. The loaded JavaScript (index.js / _helpers.js) fingerprints the host OS and CPU architecture and retrieves a platform-specific binary either over HTTPS from a rotating set of Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and a package-proxy.cf5oobworker.workers.dev through cf11oobworker.workers.dev pool) or, if that fails, by reassembling the payload from base64-encoded DNS TXT records served from wel1[.]ru subdomains (sdk.dl., ext.dl., pkg.dl., net.dl.). A companion file, lib/telemetry.js, mimics a legitimate analytics SDK to add plausibility during manual code review.
The delivered second stage, dubbed WEL1DROPPER by OpenSourceMalware (referenced once in its own reporting as 'NUL1DROPPER'), performs OS-specific defense evasion before fetching the final payload: on Windows it patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI), detects debuggers/VMs/sandboxes, and persists via Registry Run keys and scheduled tasks before pulling an encrypted update_win.exe that is reflectively loaded into memory. On macOS it detects analysis tooling (lldb, debugserver, dtrace, frida) and VMware artifacts, XOR-obfuscates (single-byte key 0x9c) its embedded infrastructure strings, persists via a LaunchAgent disguised as com.apple.windowserver.helper.plist, and downloads beacon_mac.bin. On Linux, a UPX-packed statically-linked ELF deploys an implant that researchers identified as Sliver, the open-source Bishop Fox command-and-control framework. All platforms write payloads to innocuous-looking paths (/var/tmp/.cache_<8hex>, %TEMP%\dotnet_diag_<8hex>.exe) and use a local marker file to rate-limit re-execution to roughly once every six hours (21,760 seconds).
Secondary infrastructure embedded in the macOS payload references three Russian financial-sector hostnames (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), and the use of the .ru wel1[.]ru domain for DNS-based payload delivery led OpenSourceMalware to assess the operator as likely Russian-speaking. The same researchers link this campaign's tradecraft — 'oob' infrastructure nomenclature, Russian financial-institution impersonation, and fake-telemetry camouflage — to the earlier 2026 'Moika' dependency-confusion campaign (npm accounts mr.4nd3r50n, pik-libs, t-in-one, and the @emcd-vue scope; 250+ packages impersonating SberPay and the EMCD crypto exchange), suggesting the same operator has evolved from dependency confusion to README-triggered require() social engineering at greater scale. Sonatype independently opened tracking as sonatype-2026-005660, assigning CVSS 8.7 under CWE-506 (Embedded Malicious Code) and counting 846 affected components at time of publication; no CVE has been assigned since this is malicious third-party content rather than a vulnerability in legitimate software.
MITRE ATT&CK techniques used in TL-2026-1935
Defense Evasion
T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1620 Reflective Code Loading; T1622 Debugger Evasion
Persistence
T1053.005 Scheduled Task; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Resource Development
T1583.001 Domains; T1583.006 Web Services; T1587.001 Malware; T1608.001 Upload Malware
defense-impairment
Affected products and versions in Nearly 800 Malicious npm Packages Deliver Cross-Platform
- npm, Inc. (npm public registry) — Third-party npm packages using 'bigops'/'bnpl' keyword interpolation and 35.x.y version releases (e.g. bigops-backend, bigops-api, dolyame-boxy-desktop-bnpl-card-gallery)
Vulnerable versions: All ~846 malicious package releases identified in the campaign, clustered in the 35.x.y version range
Fixed in: Malicious packages removed from the npm registry following disclosure by OpenSourceMalware and Sonatype (no upstream software patch applies)
Remediation for Nearly 800 Malicious npm Packages Deliver Cross-Platform
Patches
- Not applicable — this is malicious third-party package content, not a vulnerability in legitimate software; remediation is package removal, not patching
Immediate actions
- Treat any host that installed one of the ~846 affected packages as compromised: isolate it from the network before further investigation
- Remove the malicious package(s) and purge related version releases (35.x.y pattern, 'bigops'/'bnpl' keyword families) from lockfiles, npm caches, internal registries/mirrors, and container image layers
- Block egress to *.wel1.ru, wel1.ru, oob-worker.cf*.workers.dev, and package-proxy.cf*oobworker.workers.dev, and hunt for outbound connections to those hosts in proxy/DNS logs
- Search endpoint telemetry for the persistence artifacts: Windows Registry Run keys / scheduled tasks pointing at %TEMP%\dotnet_diag_*.exe, macOS ~/Library/LaunchAgents/com.apple.windowserver.helper.plist, and Linux/macOS processes launched from /var/tmp/.cache_*
Workarounds
- Never load package functionality via undocumented require() instructions found only in a README rather than the package's documented entrypoint
- Verify package names character-by-character against the legitimate package before installing, and avoid packages with only recently-created, low-reputation publisher accounts
- Rotate npm, cloud, and CI/CD credentials on any host that installed an affected package, only after the environment has been cleaned
Longer-term hardening
- Deploy a package-firewall / install-time allowlist (e.g. Sonatype, Socket, npm audit signals) that flags newly-published or unreviewed packages before they reach developer or CI/CD machines
- Monitor for anomalous DNS TXT-record query patterns (queries of the form c.<domain> followed by sequential <integer>.<domain> lookups) as a detection signal for DNS-based payload staging
- Prioritize behavioral detection (require()-triggered network calls, reflective in-memory execution, ETW/AMSI tampering) over static IOC matching, since the operator rotates package names and infrastructure quickly
Weaknesses (CWE) in Nearly 800 Malicious npm Packages Deliver Cross-Platform
CWE-506
Timeline of Nearly 800 Malicious npm Packages Deliver Cross-Platform
- Precursor 'Moika' dependency-confusion campaign Wave 1: npm accounts mr.4nd3r50n and pik-libs publish 164 packages across five internal scopes at version 99.99.99, establishing the 'oob' infrastructure naming and Russian-financial-sector targeting later reused in Flooding Dropper.
- Moika Wave 2: npm account t-in-one publishes 12 packages impersonating Sberbank's SberPay payment SDK.
- Moika Wave 3: the @emcd-vue scope impersonates EMCD, a Russian cryptocurrency exchange, continuing the operator's Russian-financial-sector lure pattern; SafeDep documents 260+ threat reports tied to oob.moika.tech infrastructure.
- Sonatype Research Labs opens tracking as sonatype-2026-005660 ('Flooding Dropper'), assigns CVSS 8.7 under CWE-506, and counts 846 malicious npm components using 'bigops'/'bnpl' keyword interpolation and 35.x.y version releases.
- OpenSourceMalware researcher Paul McCarty reports the first malicious package, bigops-backend, delivering a platform-specific binary dropper to Windows, Linux, and macOS installers.
- OpenSourceMalware publishes a deep-dive identifying the WEL1DROPPER downloader, DNS TXT-record payload-reconstruction technique, wel1[.]ru and Cloudflare Workers C2 infrastructure, and a Sliver C2 implant final stage; tracked package count reaches 788 over 48 hours.
- The Hacker News publishes coverage of the campaign, reporting nearly 800 malicious npm packages delivering the cross-platform WEL1DROPPER RAT and infostealer.
Sources cited for Nearly 800 Malicious npm Packages Deliver Cross-Platform
- Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
- 'Flooding Dropper' Campaign Hits npm With Nearly 850 Malicious Packages
- Flooding Dropper Hits npm With 850 Malicious Packages
- Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
- Flooding Dropper Hits npm With 850 Malicious Packages (syndicated)
- 183 npm Packages Target Cloud and Finance via oob.moika.tech
- MAL-2026-5041 (Moika campaign malicious package advisory)
- The npm Threat Landscape: Attack Surface and Mitigations
Threats related to Nearly 800 Malicious npm Packages Deliver Cross-Platform
Detection coverage for TL-2026-1935
As of 2026-08-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1935 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.