Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign) — Threadlinqs Intelligence
As of 2026-08-07, Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign) is a high-severity supply chain threat attributed to Unknown ("Flooding Dropper" operator (Russia (suspected, unconfirmed)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1935 · Severity: HIGH · CVSS: 8.7 · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Unknown ("Flooding Dropper" operator · Russia (suspected, unconfirmed) · FINANCIAL
A suspected Russian-speaking threat actor published roughly 800-846 AI-slopsquatted npm packages (tracked by Sonatype as 'Flooding Dropper', sonatype-2026-005660, and by OpenSourceMalware as the
Beginning around early August 2026, an automated npm-publishing operation flooded the registry with close to 850 malicious packages built around interpolated keyword pairs such as 'bigops' and 'bnpl' (e.g. bigops-backend, bigops-api, dolyame-boxy-desktop-bnpl-card-gallery), clustering releases in a recurring 35.x.y version range. Rather than relying on npm lifecycle hooks (preinstall/postinstall), the packages instruct developers via README text to load the malicious functionality through a plain require() call, sidestepping install-time scanning that focuses on lifecycle scripts. The loaded JavaScript (index.js / _helpers.js) fingerprints the host OS and CPU architecture and retrieves a platform-specific binary either over HTTPS from a rotating set of Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and a package-proxy.cf5oobworker.workers.dev through cf11oobworker.workers.dev pool) or, if that fails, by reassembling the payload from base64-encoded DNS TXT records served from wel1[.]ru subdomains (sdk.dl., ext.dl., pkg.dl., net.dl.). A companion file, lib/telemetry.js, mimics a legitimate analytics SDK to add plausibility during manual code review.
The delivered second stage, dubbed WEL1DROPPER by OpenSourceMalware (referenced once in its own reporting as 'NUL1DROPPER'), performs OS-specific defense evasion before fetching the final payload: on Windows it patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI), detects debuggers/VMs/sandboxes, and persists via Registry Run keys and scheduled tasks before pulling an encrypted update_win.exe that is reflectively loaded into memory. On macOS it detects analysis tooling (lldb, debugserver, dtrace, frida) and VMware artifacts, XOR-obfuscates (single-byte key 0x9c) its embedded infrastructure strings, persists via a LaunchAgent disguised as com.apple.windowserver.helper.plist, and downloads beacon_mac.bin. On Linux, a UPX-packed statically-linked ELF deploys an implant that researchers identified as Sliver, the open-source Bishop Fox command-and-control framework. All platforms write payloads to innocuous-looking paths (/var/tmp/.cache_<8hex>, %TEMP%\dotnet_diag_<8hex>.exe) and use a local marker file to rate-limit re-execution to roughly once every six hours (21,760 seconds).
Secondary infrastructure embedded in the macOS payload references three Russian financial-sector hostnames (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), and the use of the .ru wel1[.]ru domain for DNS-based payload delivery led OpenSourceMalware to assess the operator as likely Russian-speaking. The same researchers link this campaign's tradecraft — 'oob' infrastructure nomenclature, Russian financial-institution impersonation, and fake-telemetry camouflage — to the earlier 2026 'Moika' dependency-confusion campaign (npm accounts mr.4nd3r50n, pik-libs, t-in-one, and the @emcd-vue scope; 250+ packages impersonating SberPay and the EMCD crypto exchange), suggesting the same operator has evolved from dependency confusion to README-triggered require() social engineering at greater scale. Sonatype independently opened tracking as sonatype-2026-005660, assigning CVSS 8.7 under CWE-506 (Embedded Malicious Code) and counting 846 affected components at time of publication; no CVE has been assigned since this is malicious third-party content rather than a vulnerability in legitimate software.
Target sectors: technology, finance, softwaredevelopment
Target regions: Global, russia
Detections & IOCs
As of 2026-08-07, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1608.001, T1587.001, T1583.001, T1583.006, T1195.001, T1059.007, T1204.002, T1547.001, T1053.005, T1543.001
