Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper")
Suspected Russian Actor Uses AI Slopsquatting to Publish (TL-2026-1951), also tracked as WEL1DROPPER, is a high-severity supply-chain compromise scored CVSS 8.7, first published 2026-08-09. It is linked to a Russia-nexus actor with medium confidence, affects npm, Inc. (npm public registry) Node.js projects installing tainted, maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-1951
- Threat ID
- TL-2026-1951
- Also known as
- WEL1DROPPER, Flooding Dropper, sonatype-2026-005660
- Severity
- HIGH
- CVSS
- 8.7
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-08-09
- Last reviewed
- 2026-08-09
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, financial services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Suspected Russian Actor Uses AI Slopsquatting to Publish
Malware and tooling: Sliver, WEL1DROPPER
A suspected Russian threat actor, attributed with moderate confidence, is registering AI-hallucinated npm package names ("AI slopsquatting") that coding assistants tend to suggest to developers. The campaign — tracked as WEL1DROPPER by OpenSourceMalware and as "Flooding Dropper" (sonatype-2026-005660) by Sonatype — grew from 700+ to 1,000+ malicious packages within 48 hours starting August 4-5, 2026, infecting Windows, macOS, and Linux hosts via a single require() call with no install scripts, and delivering a suspected Sliver C2 implant on Linux.
How Suspected Russian Actor Uses AI Slopsquatting to Publish works
Beginning around August 4-5, 2026, researchers at Sonatype Research Labs and independent analyst Paul McCarty (OpenSourceMalware) independently identified a fast-moving npm supply-chain campaign that published hundreds of malicious packages within 48 hours, reaching roughly 788-850 packages by August 5-6 and exceeding 1,000 by August 8. Sonatype tracks the activity internally as sonatype-2026-005660 ("Flooding Dropper"); OpenSourceMalware named the downloader WEL1DROPPER.
The campaign is notable for its infection vector: rather than abusing npm's preinstall/postinstall lifecycle hooks, the malicious packages (e.g. checkout-mobile-bnpl@35.6.9, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery) masquerade as small mobile/BNPL SDKs with plausible init(), version(), and configure() methods. Their README instructs a developer to simply require() the package, which auto-executes a bundled _helpers.js first-stage loader. This is the technique researchers are calling "AI slopsquatting": the package names are AI-hallucination-style compound names of the kind coding assistants have been shown to confidently suggest even though they don't exist, rather than classic typo-variants of real packages.
Once loaded, the first-stage JavaScript fingerprints host OS and CPU architecture and fetches a matching second-stage binary (Linux x64/ARM64 ELF, universal macOS Mach-O, or Windows PE) from one of several rotating Cloudflare Workers hosts (oob-worker*.workers.dev, package-proxy.cf*oobworker.workers.dev), falling back to reconstructing the payload from Base64-encoded DNS TXT record chunks served under the wel1.ru domain if HTTPS delivery is blocked. Dropped binaries use disguised filenames (/var/tmp/.cache_<hex> on Linux/macOS, %TEMP%\dotnet_diag_<hex>.exe on Windows) and are launched as detached background processes so that killing the parent Node.js process does not stop the infection. A fake "analytics" marker file throttles re-infection with an approximately six-hour cooldown.
The Linux payload is UPX-packed and statically linked; the macOS payload is a universal (Intel + Apple Silicon) binary that checks for debuggers (lldb, debugserver, dtrace, frida), Wireshark, VMware artifacts, and low physical memory before proceeding, and persists via a disguised LaunchAgent (~/Library/LaunchAgents/com.apple.windowserver.helper.plist). Infrastructure strings in the macOS binary are single-byte XOR-encoded (key 0x9c) and decode to additional attacker-controlled hosts referencing Russian financial institutions (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), used by researchers as decoy/health-check traffic and as the basis for a moderate-confidence Russian attribution. Separately, Sonatype documented a Windows-specific second stage that patches Event Tracing for Windows (ETW) and tampers with the Antimalware Scan Interface (AMSI), establishes persistence via a Registry Run key and a scheduled task, and reflectively loads an encrypted payload in memory. The Linux payload is suspected — per a researcher cited by OpenSourceMalware, not yet independently confirmed — of ultimately deploying a Sliver implant, the open-source red-team C2 framework originally built by Bishop Fox.
Researchers link WEL1DROPPER/Flooding Dropper to the earlier "Moika" campaign (250+ npm packages published April-May 2026 via oob.moika.tech) based on shared tradecraft: "oob"-named infrastructure, fake telemetry camouflage, and similar kill-switch/rate-limiting mechanisms. The attacker publishes through many disposable, apparently automated npm accounts rather than one prolific publisher, which frustrates simple account-based takedown.
MITRE ATT&CK techniques used in TL-2026-1951
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1622 Debugger Evasion
Persistence
T1053.005 Scheduled Task; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1071.004 DNS; T1102.002 Bidirectional Communication
Discovery
T1082 System Information Discovery
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Resource Development
defense-impairment
Affected products and versions in Suspected Russian Actor Uses AI Slopsquatting to Publish
- npm, Inc. (npm public registry) — Node.js projects installing tainted npm packages
Vulnerable versions: 1,000+ discrete malicious npm packages, e.g. checkout-mobile-bnpl@35.6.9, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery
Fixed in: Malicious packages removed from the registry following researcher takedown reports; no vendor patch applies since these are attacker-published packages, not a vulnerability in legitimate software
Remediation for Suspected Russian Actor Uses AI Slopsquatting to Publish
Immediate actions
- Remove any of the 1,000+ WEL1DROPPER/Flooding Dropper npm packages (e.g. checkout-mobile-bnpl, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery) from package.json/lockfiles and treat any host that installed one as compromised, not merely cleaned, since infection triggers on require() with no install script needed
- Block and alert on DNS queries to wel1.ru and its subdomains (sdk.dl, ext.dl, pkg.dl, net.dl, dl) and on HTTPS traffic to oob-worker*.workers.dev / package-proxy.cf*oobworker.workers.dev Cloudflare Workers hosts
- Hunt for dropped artifacts: /var/tmp/.cache_<hex> and %TEMP%\dotnet_diag_<hex>.exe payload files, the .analytics_state rate-limit marker, and the ~/Library/LaunchAgents/com.apple.windowserver.helper.plist macOS LaunchAgent
- On Windows, check for ETW-patching/AMSI-tampering indicators, unexpected Registry Run key entries, and newly created scheduled tasks
- Rotate developer credentials, npm publish tokens, and CI/CD secrets only after remediation of affected hosts is complete
Workarounds
- Pin dependencies to previously audited, known-good versions and disable automatic resolution of newly published package versions until vetted
Longer-term hardening
- Require verification of any AI-coding-assistant-suggested package name against the real registry before installation, to mitigate slopsquatting
- Deploy package-provenance/SBOM scanning and slopsquat/typosquat detection gates in CI pipelines
- Monitor DNS logs for anomalous TXT-record query volume as a C2-channel indicator, since this campaign is deliberately designed around rotating Cloudflare Workers and DNS fallback to evade static IP blocklists
- Alert on LaunchAgent creation, Registry Run key writes, and scheduled-task creation outside standard admin/build workflows
Weaknesses (CWE) in Suspected Russian Actor Uses AI Slopsquatting to Publish
CWE-506
Timeline of Suspected Russian Actor Uses AI Slopsquatting to Publish
- The tradecraft-linked "Moika" campaign publishes 250+ malicious npm packages (April-May 2026) using 'oob'-named C2 infrastructure (oob.moika.tech), fake telemetry camouflage, and kill-switch mechanisms later reused in WEL1DROPPER.
- A 48-hour surge of AI-slopsquatted npm package publications begins, later reported by researchers as 700+ malicious packages.
- Sonatype Research Labs discloses the campaign, tracked internally as sonatype-2026-005660 ("Flooding Dropper"), reporting roughly 846-850 malicious npm components using 'bigops'/'bnpl' naming patterns and 35.x.y version ranges.
- OpenSourceMalware analyst Paul McCarty publishes a detailed technical writeup naming the downloader WEL1DROPPER, documenting the checkout-mobile-bnpl package, C2 infrastructure, and XOR-decoded Russian financial-institution decoy strings.
- The Hacker News and other outlets report nearly 800 malicious npm packages delivering a cross-platform RAT/infostealer, adding Windows-specific ETW-patching and AMSI-tampering details.
- GBHackers reports the malicious-package count has grown past 1,000, with the campaign attributed to a suspected Russian actor with moderate confidence and a suspected Sliver implant as the final Linux payload.
Sources cited for Suspected Russian Actor Uses AI Slopsquatting to Publish
- Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages
- Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
- Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
- Flooding Dropper Hits npm With 850 Malicious Packages
- Russian AI Slopsquatting Campaign Floods npm With Malicious Packages Targeting Developers
- Flooding Dropper Campaign Seeds 850 Malicious npm Packages
Threats related to Suspected Russian Actor Uses AI Slopsquatting to Publish
- Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign)
- TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bank
- GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)
Detection coverage for TL-2026-1951
As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1951 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1951
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.