# Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign)

> A suspected Russian-speaking threat actor published roughly 800-846 AI-slopsquatted npm packages (tracked by Sonatype as 'Flooding Dropper', sonatype-2026-005660, and by OpenSourceMalware as the WEL1DROPPER campaign) that lure developers into executing a require()-triggered downloader documented only in the package README. The downloader deploys platform-specific final payloads — a Sliver C2 implant on Linux, update_win.exe on Windows, and beacon_mac.bin on macOS — using ETW/AMSI patching, sandbox/debugger evasion, and native OS persistence.

- **Published:** 2026-08-07T00:00:00Z
- **Last reviewed:** 2026-08-07T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1935
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-wel1dropper-npm-supply-chain-tl-2026-1935.webp?v=e34f41e8 (Threadlinqs threat intel: WEL1DROPPER npm RAT: Detection & IOCs (TL-2026-1935) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-1935
- **Severity:** HIGH (CVSS 8.7)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Beginning around early August 2026, an automated npm-publishing operation flooded the registry with close to 850 malicious packages built around interpolated keyword pairs such as 'bigops' and 'bnpl' (e.g. bigops-backend, bigops-api, dolyame-boxy-desktop-bnpl-card-gallery), clustering releases in a recurring 35.x.y version range. Rather than relying on npm lifecycle hooks (preinstall/postinstall), the packages instruct developers via README text to load the malicious functionality through a plain require() call, sidestepping install-time scanning that focuses on lifecycle scripts. The loaded JavaScript (index.js / _helpers.js) fingerprints the host OS and CPU architecture and retrieves a platform-specific binary either over HTTPS from a rotating set of Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and a package-proxy.cf5oobworker.workers.dev through cf11oobworker.workers.dev pool) or, if that fails, by reassembling the payload from base64-encoded DNS TXT records served from wel1[.]ru subdomains (sdk.dl., ext.dl., pkg.dl., net.dl.). A companion file, lib/telemetry.js, mimics a legitimate analytics SDK to add plausibility during manual code review.

The delivered second stage, dubbed WEL1DROPPER by OpenSourceMalware (referenced once in its own reporting as 'NUL1DROPPER'), performs OS-specific defense evasion before fetching the final payload: on Windows it patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI), detects debuggers/VMs/sandboxes, and persists via Registry Run keys and scheduled tasks before pulling an encrypted update_win.exe that is reflectively loaded into memory. On macOS it detects analysis tooling (lldb, debugserver, dtrace, frida) and VMware artifacts, XOR-obfuscates (single-byte key 0x9c) its embedded infrastructure strings, persists via a LaunchAgent disguised as com.apple.windowserver.helper.plist, and downloads beacon_mac.bin. On Linux, a UPX-packed statically-linked ELF deploys an implant that researchers identified as Sliver, the open-source Bishop Fox command-and-control framework. All platforms write payloads to innocuous-looking paths (/var/tmp/.cache_<8hex>, %TEMP%\dotnet_diag_<8hex>.exe) and use a local marker file to rate-limit re-execution to roughly once every six hours (21,760 seconds).

Secondary infrastructure embedded in the macOS payload references three Russian financial-sector hostnames (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), and the use of the .ru wel1[.]ru domain for DNS-based payload delivery led OpenSourceMalware to assess the operator as likely Russian-speaking. The same researchers link this campaign's tradecraft — 'oob' infrastructure nomenclature, Russian financial-institution impersonation, and fake-telemetry camouflage — to the earlier 2026 'Moika' dependency-confusion campaign (npm accounts mr.4nd3r50n, pik-libs, t-in-one, and the @emcd-vue scope; 250+ packages impersonating SberPay and the EMCD crypto exchange), suggesting the same operator has evolved from dependency confusion to README-triggered require() social engineering at greater scale. Sonatype independently opened tracking as sonatype-2026-005660, assigning CVSS 8.7 under CWE-506 (Embedded Malicious Code) and counting 846 affected components at time of publication; no CVE has been assigned since this is malicious third-party content rather than a vulnerability in legitimate software.

## MITRE ATT&CK

- T1608.001 Upload Malware
- T1587.001 Malware
- T1583.001 Domains
- T1583.006 Web Services
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1543.001 Launch Agent
- T1685 Disable or Modify Tools
- T1622 Debugger Evasion
- T1497.001 System Checks
- T1620 Reflective Code Loading
- T1027.002 Software Packing
- T1036.005 Match Legitimate Resource Name or Location
- T1071.004 DNS

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Windows ETW/AMSI Tamper Preceding Persistence via Run Key or Scheduled Task** (`TL-2026-1935-SPL-002`)

Detects the WEL1DROPPER Windows post-exploitation chain: ETW provider unhooking or AMSI.dll patching (via memory patch/API-hook indicators) followed by creation of a Registry Run key or Scheduled Task referencing the disguised staging path %TEMP%\dotnet_diag_<8hex>.exe, ahead of the reflectively-loaded update_win.exe final payload.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1685, T1547.001, T1053.005, T1622, T1497.001
- **Data sources:** sysmon, windows_security, edr_registry_events, edr_process_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon (EventCode=7 AND (ImageLoaded="*amsi.dll" OR ImageLoaded="*\\combase.dll"))
| eval evasion_time=_time
| join type=inner Computer [
    search index=sysmon (EventCode=13 OR EventCode=1) earliest=-10m
    ( (EventCode=13 AND TargetObject="*\\CurrentVersion\\Run\\*" AND Details="*dotnet_diag_*")
      OR (EventCode=1 AND CommandLine="*schtasks*" AND CommandLine="*dotnet_diag_*") )
    | rename _time as persist_time
    | fields Computer, TargetObject, Details, CommandLine, persist_time
  ]
| where persist_time >= evasion_time AND persist_time <= evasion_time + 600
| table evasion_time, persist_time, Computer, ImageLoaded, TargetObject, Details, CommandLine
| sort -persist_time
```

### Microsoft KQL

```kql
let evasion = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "AmsiProviderLoaded" or (ActionType == "ProcessCreated" and AdditionalFields has "NtSetInformationThread");
let persistence = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueData has "dotnet_diag_";
evasion
| join kind=inner (persistence) on DeviceId
| where persistence.Timestamp - evasion.Timestamp between (0min .. 10min)
| project EvasionTime = evasion.Timestamp, PersistTime = persistence.Timestamp, DeviceName = evasion.DeviceName, RegistryKey = persistence.RegistryKey, RegistryValueData = persistence.RegistryValueData
| order by PersistTime desc
```

### Sigma

```yaml
title: AMSI/ETW Tamper Followed by dotnet_diag_ Persistence (WEL1DROPPER)
id: 1a2b3c4d-7e8f-4901-b2c3-d4e5f6a7b8c9
status: experimental
description: Detects AMSI/ETW defense-impairment activity closely followed by Registry Run key or Scheduled Task persistence referencing the WEL1DROPPER disguised staging filename pattern dotnet_diag_<8hex>.exe.
references:
  - https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-07
tags:
  - attack.defense-evasion
  - attack.t1685
  - attack.persistence
  - attack.t1547.001
  - attack.t1053.005
  - attack.malware.wel1dropper
logsource:
  category: registry_event
  product: windows
detection:
  selection_persist:
    TargetObject|contains: 'CurrentVersion\Run'
    Details|contains: 'dotnet_diag_'
  selection_task:
    CommandLine|contains:
      - 'schtasks'
      - 'dotnet_diag_'
  condition: selection_persist or selection_task
falsepositives:
  - Legitimate .NET diagnostics tooling that happens to use a similarly-named temp file unrelated to the campaign (rare given the random 8-hex suffix)
level: critical
```

**Known false positives:**

- Legitimate security or diagnostics agents that load amsi.dll for benign scanning purposes coinciding by chance with unrelated Run-key creation

**Tuning notes:** Add the exact dotnet_diag_ 8-hex-suffix regex to the persistence selector to sharpen precision; correlate with the marker-file rate-limit behavior (~21,760s re-execution interval) for additional confidence scoring.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Platform-Specific WEL1DROPPER Payload Fetch Following Node Process Fingerprinting (locked: unlock with TL Creds)
- Suspicious Reflective In-Memory Load of [indicator] After AMSI/ETW Impairment (locked: unlock with TL Creds)
- Sliver C2 Beacon Callback and Local Health-Check Port on Linux Hosts (locked: unlock with TL Creds)
- Malicious npm Package Name/Version Pattern Install (bigops/bnpl Keyword Interpolation) (locked: unlock with TL Creds)
- macOS/Linux WEL1DROPPER Persistence via Disguised LaunchAgent or Cache Staging Path (locked: unlock with TL Creds)
- Rate-Limited Re-Execution Marker File Consistent With WEL1DROPPER C2 Cadence (locked: unlock with TL Creds)
- npm require() Downloader First-Contact Callout to Flooding Dropper Infrastructure (locked: unlock with TL Creds)
- DNS TXT-Record Payload Reassembly Against [indicator] C2 Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- Domain: `oob-worker[.]cf103-070[.]workers[.]dev`
- File hash: `7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3`
- Domain: `oob-worker[.]cf102-baf[.]workers[.]dev`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer](https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html)
- ['Flooding Dropper' Campaign Hits npm With Nearly 850 Malicious Packages](https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages)
- [Flooding Dropper Hits npm With 850 Malicious Packages](https://securityboulevard.com/2026/08/flooding-dropper-hits-npm-with-850-malicious-packages/)
- [Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages](https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign)
- [Flooding Dropper Hits npm With 850 Malicious Packages (syndicated)](https://malware.news/t/flooding-dropper-hits-npm-with-850-malicious-packages/124541)
- [183 npm Packages Target Cloud and Finance via oob.moika.tech](https://safedep.io/oob-moika-tech-dependency-confusion-campaign/)
- [MAL-2026-5041 (Moika campaign malicious package advisory)](https://osv.dev/vulnerability/MAL-2026-5041)
- [The npm Threat Landscape: Attack Surface and Mitigations](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1935