Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper")

Key facts for WEL1DROPPER AI slopsquatting npm

Detection coverage for WEL1DROPPER AI slopsquatting npm

As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1951 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WEL1DROPPER Malicious npm Package require() Execution

Detects a Node.js/npm process whose command line or dropped-file hash matches a known WEL1DROPPER/Flooding Dropper AI-slopsquatted package (checkout-mobile-bnpl, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery) or its first-stage loader (_helpers.js) / entrypoint (index.js) SHA-256, indicating the package's require() call has auto-executed with no install script needed.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1059.007, T1204.002, T1036.005
• Data sources: sysmon, windows_security, npm_registry_logs, edr_process_telemetry
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImage=lower(ParentImage)
| where ParentImage="*\\node.exe" OR ParentImage="*/node" OR ParentImage="*\\npm.cmd" OR ParentImage="*/npm"
| where match(CommandLine, "(?i)(checkout-mobile-bnpl|bigops-backend|dolyame-boxy-desktop-bnpl-card-gallery)") OR match(Hashes, "(?i)(94EF6B1C4A9D31F78F446D053048BCEF34FD88F4436A1A46F7F777A9E9C83A29|B74C5675725911C62091BDF40714DF760CC2AF7A88360D21065F4E1C878AA8F0)")
| table _time, host, User, ParentImage, Image, CommandLine, Hashes
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe","node","npm.cmd","npm")
| where ProcessCommandLine has_any ("checkout-mobile-bnpl","bigops-backend","dolyame-boxy-desktop-bnpl-card-gallery")
   or SHA256 in~ ("94ef6b1c4a9d31f78f446d053048bcef34fd88f4436a1a46f7f777a9e9c83a29","b74c5675725911c62091bdf40714df760cc2af7a88360d21065f4e1c878aa8f0")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: WEL1DROPPER Malicious npm Package require() Execution
id: 7b2f1a44-3e6d-4a1a-9d2b-1c4e7f0a9b21
status: experimental
description: Detects Node.js/npm process execution referencing known WEL1DROPPER/Flooding Dropper malicious npm package names or first-stage loader (_helpers.js) file hashes, indicating the AI-slopsquatted package's require() call has auto-executed.
references:
    - https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign
    - https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-09
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.execution
    - attack.t1059.007
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_process:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
    selection_pkg:
        CommandLine|contains:
            - 'checkout-mobile-bnpl'
            - 'bigops-backend'
            - 'dolyame-boxy-desktop-bnpl-card-gallery'
    selection_hash:
        Hashes|contains:
            - '94EF6B1C4A9D31F78F446D053048BCEF34FD88F4436A1A46F7F777A9E9C83A29'
            - 'B74C5675725911C62091BDF40714DF760CC2AF7A88360D21065F4E1C878AA8F0'
    condition: selection_process and (selection_pkg or selection_hash)
falsepositives:
    - Legitimate internal package with a coincidentally similar name (verify against npm registry ownership)
    - Security researchers intentionally installing the sample in an isolated sandbox for analysis
level: critical

Known false positives:

• Legitimate internal package with a coincidentally similar name — verify npm registry ownership and publisher history before treating as malicious
• Security researchers intentionally installing the sample in an isolated sandbox for analysis

Tuning notes: Extend the CommandLine/package-name match list as new WEL1DROPPER-style package names are identified via the Sonatype/OpenSourceMalware trackers; add file-hash IOC updates for _helpers.js/index.js variants as new samples surface.

• 🔒 WEL1DROPPER Malicious npm Package require() Execution · unlock with TL Creds
• 🔒 WEL1DROPPER Cross-Platform Persistence and Defense Evasion · unlock with TL Creds
• 🔒 WEL1DROPPER / Sliver C2 Beacon to Known Campaign Infrastructure · unlock with TL Creds
• 🔒 WEL1DROPPER Malicious npm Package require() Execution · unlock with TL Creds
• 🔒 WEL1DROPPER Cross-Platform Persistence and Defense Evasion · unlock with TL Creds
• 🔒 WEL1DROPPER / Sliver C2 Beacon to Known Campaign Infrastructure · unlock with TL Creds
• 🔒 WEL1DROPPER Cross-Platform Persistence and Defense Evasion · unlock with TL Creds
• 🔒 WEL1DROPPER / Sliver C2 Beacon to Known Campaign Infrastructure · unlock with TL Creds

Indicators of compromise for WEL1DROPPER AI slopsquatting npm

As of 2026-08-09, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-1951.

Sample indicators (3 of 30)

• Domain: wel1[.]ru
• File hash: 0fc30f82e1fa5e51a6c0c43f3ed7f13592ea731cb331e43a4d085df60a4db8b6
• Domain: oob-worker[.]cf103-070[.]workers[.]dev

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Community OSINT corroboration for WEL1DROPPER AI slopsquatting npm

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How WEL1DROPPER AI slopsquatting npm works

Beginning around August 4-5, 2026, researchers at Sonatype Research Labs and independent analyst Paul McCarty (OpenSourceMalware) independently identified a fast-moving npm supply-chain campaign that published hundreds of malicious packages within 48 hours, reaching roughly 788-850 packages by August 5-6 and exceeding 1,000 by August 8. Sonatype tracks the activity internally as sonatype-2026-005660 ("Flooding Dropper"); OpenSourceMalware named the downloader WEL1DROPPER.

The campaign is notable for its infection vector: rather than abusing npm's preinstall/postinstall lifecycle hooks, the malicious packages (e.g. checkout-mobile-bnpl@35.6.9, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery) masquerade as small mobile/BNPL SDKs with plausible init(), version(), and configure() methods. Their README instructs a developer to simply require() the package, which auto-executes a bundled _helpers.js first-stage loader. This is the technique researchers are calling "AI slopsquatting": the package names are AI-hallucination-style compound names of the kind coding assistants have been shown to confidently suggest even though they don't exist, rather than classic typo-variants of real packages.

Once loaded, the first-stage JavaScript fingerprints host OS and CPU architecture and fetches a matching second-stage binary (Linux x64/ARM64 ELF, universal macOS Mach-O, or Windows PE) from one of several rotating Cloudflare Workers hosts (oob-worker*.workers.dev, package-proxy.cf*oobworker.workers.dev), falling back to reconstructing the payload from Base64-encoded DNS TXT record chunks served under the wel1.ru domain if HTTPS delivery is blocked. Dropped binaries use disguised filenames (/var/tmp/.cache_<hex> on Linux/macOS, %TEMP%\dotnet_diag_<hex>.exe on Windows) and are launched as detached background processes so that killing the parent Node.js process does not stop the infection. A fake "analytics" marker file throttles re-infection with an approximately six-hour cooldown.

The Linux payload is UPX-packed and statically linked; the macOS payload is a universal (Intel + Apple Silicon) binary that checks for debuggers (lldb, debugserver, dtrace, frida), Wireshark, VMware artifacts, and low physical memory before proceeding, and persists via a disguised LaunchAgent (~/Library/LaunchAgents/com.apple.windowserver.helper.plist). Infrastructure strings in the macOS binary are single-byte XOR-encoded (key 0x9c) and decode to additional attacker-controlled hosts referencing Russian financial institutions (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), used by researchers as decoy/health-check traffic and as the basis for a moderate-confidence Russian attribution. Separately, Sonatype documented a Windows-specific second stage that patches Event Tracing for Windows (ETW) and tampers with the Antimalware Scan Interface (AMSI), establishes persistence via a Registry Run key and a scheduled task, and reflectively loads an encrypted payload in memory. The Linux payload is suspected — per a researcher cited by OpenSourceMalware, not yet independently confirmed — of ultimately deploying a Sliver implant, the open-source red-team C2 framework originally built by Bishop Fox.

Researchers link WEL1DROPPER/Flooding Dropper to the earlier "Moika" campaign (250+ npm packages published April-May 2026 via oob.moika.tech) based on shared tradecraft: "oob"-named infrastructure, fake telemetry camouflage, and similar kill-switch/rate-limiting mechanisms. The attacker publishes through many disposable, apparently automated npm accounts rather than one prolific publisher, which frustrates simple account-based takedown.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1622 Debugger Evasion

Persistence

T1053.005 Scheduled Task; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1071.004 DNS; T1102.002 Bidirectional Communication

Discovery

T1082 System Information Discovery

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools

Resource Development

T1583.006 Web Services

defense-impairment

T1685 Disable or Modify Tools

Remediation for WEL1DROPPER AI slopsquatting npm

Immediate actions

• Remove any of the 1,000+ WEL1DROPPER/Flooding Dropper npm packages (e.g. checkout-mobile-bnpl, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery) from package.json/lockfiles and treat any host that installed one as compromised, not merely cleaned, since infection triggers on require() with no install script needed
• Block and alert on DNS queries to wel1.ru and its subdomains (sdk.dl, ext.dl, pkg.dl, net.dl, dl) and on HTTPS traffic to oob-worker*.workers.dev / package-proxy.cf*oobworker.workers.dev Cloudflare Workers hosts
• Hunt for dropped artifacts: /var/tmp/.cache_<hex> and %TEMP%\dotnet_diag_<hex>.exe payload files, the .analytics_state rate-limit marker, and the ~/Library/LaunchAgents/com.apple.windowserver.helper.plist macOS LaunchAgent
• On Windows, check for ETW-patching/AMSI-tampering indicators, unexpected Registry Run key entries, and newly created scheduled tasks
• Rotate developer credentials, npm publish tokens, and CI/CD secrets only after remediation of affected hosts is complete

Workarounds

• Pin dependencies to previously audited, known-good versions and disable automatic resolution of newly published package versions until vetted

Longer-term hardening

• Require verification of any AI-coding-assistant-suggested package name against the real registry before installation, to mitigate slopsquatting
• Deploy package-provenance/SBOM scanning and slopsquat/typosquat detection gates in CI pipelines
• Monitor DNS logs for anomalous TXT-record query volume as a C2-channel indicator, since this campaign is deliberately designed around rotating Cloudflare Workers and DNS fallback to evade static IP blocklists
• Alert on LaunchAgent creation, Registry Run key writes, and scheduled-task creation outside standard admin/build workflows

Affected and fixed versions

• npm, Inc. (npm public registry) — Node.js projects installing tainted npm packages
  Vulnerable versions: 1,000+ discrete malicious npm packages, e.g. checkout-mobile-bnpl@35.6.9, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery
  Fixed in: Malicious packages removed from the registry following researcher takedown reports; no vendor patch applies since these are attacker-published packages, not a vulnerability in legitimate software

Timeline of WEL1DROPPER AI slopsquatting npm

• 2026-05-01 The tradecraft-linked "Moika" campaign publishes 250+ malicious npm packages (April-May 2026) using 'oob'-named C2 infrastructure (locked-ioc-25), fake telemetry camouflage, and kill-switch mechanisms later reused in locked-ioc-27.
• 2026-08-04 A 48-hour surge of AI-slopsquatted npm package publications begins, later reported by researchers as 700+ malicious packages.
• 2026-08-05 Sonatype Research Labs discloses the campaign, tracked internally as sonatype-2026-005660 ("Flooding Dropper"), reporting roughly 846-850 malicious npm components using 'bigops'/'bnpl' naming patterns and 35.x.y version ranges.
• 2026-08-06 OpenSourceMalware analyst Paul McCarty publishes a detailed technical writeup naming the downloader locked-ioc-27, documenting the locked-ioc-17 package, C2 infrastructure, and XOR-decoded Russian financial-institution decoy strings.
• 2026-08-07 The Hacker News and other outlets report nearly 800 malicious npm packages delivering a cross-platform RAT/infostealer, adding Windows-specific ETW-patching and AMSI-tampering details.
• 2026-08-08 GBHackers reports the malicious-package count has grown past 1,000, with the campaign attributed to a suspected Russian actor with moderate confidence and a suspected locked-ioc-30 implant as the final Linux payload.

Sources cited for WEL1DROPPER AI slopsquatting npm

• Flooding Dropper Hits npm With 850 Malicious Packages sonatype.com · Vendor report · 2026-08-05
• Flooding Dropper Campaign Seeds 850 Malicious npm Packages mallory.ai · Research · 2026-08-07
• Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages opensourcemalware.com · Blog · 2026-08-06
• Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages gbhackers.com · News · 2026-08-08
• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer The Hacker News · News · 2026-08-07
• Russian AI Slopsquatting Campaign Floods npm With Malicious Packages Targeting Developers cyberpress.org · News · 2026-08-07

Threats related to WEL1DROPPER AI slopsquatting npm

• Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign)
• TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bank
• GlassWorm Developer Supply Chain Campaign Takedown — CrowdStrike + Google + Shadowserver Disrupt 4-Channel C2 (Solana / BitTorrent DHT / Google Calendar / VPS)

Previous and next in supply chain

• Head Mare Breaches TrueConf Servers to Trojanize Client Installers with PhantomCore/PhantomGraph Backdoors Previous report
• WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages