Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper") — Threadlinqs Intelligence
As of 2026-08-09, Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper") is a high-severity supply chain threat attributed to a Russia-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1951 · Severity: HIGH · CVSS: 8.7 · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Russia · UNKNOWN
A suspected Russian threat actor, attributed with moderate confidence, is registering AI-hallucinated npm package names ("AI slopsquatting") that coding assistants tend to suggest to developers. The
Beginning around August 4-5, 2026, researchers at Sonatype Research Labs and independent analyst Paul McCarty (OpenSourceMalware) independently identified a fast-moving npm supply-chain campaign that published hundreds of malicious packages within 48 hours, reaching roughly 788-850 packages by August 5-6 and exceeding 1,000 by August 8. Sonatype tracks the activity internally as sonatype-2026-005660 ("Flooding Dropper"); OpenSourceMalware named the downloader WEL1DROPPER.
The campaign is notable for its infection vector: rather than abusing npm's preinstall/postinstall lifecycle hooks, the malicious packages (e.g. checkout-mobile-bnpl@35.6.9, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery) masquerade as small mobile/BNPL SDKs with plausible init(), version(), and configure() methods. Their README instructs a developer to simply require() the package, which auto-executes a bundled _helpers.js first-stage loader. This is the technique researchers are calling "AI slopsquatting": the package names are AI-hallucination-style compound names of the kind coding assistants have been shown to confidently suggest even though they don't exist, rather than classic typo-variants of real packages.
Once loaded, the first-stage JavaScript fingerprints host OS and CPU architecture and fetches a matching second-stage binary (Linux x64/ARM64 ELF, universal macOS Mach-O, or Windows PE) from one of several rotating Cloudflare Workers hosts (oob-worker*.workers.dev, package-proxy.cf*oobworker.workers.dev), falling back to reconstructing the payload from Base64-encoded DNS TXT record chunks served under the wel1.ru domain if HTTPS delivery is blocked. Dropped binaries use disguised filenames (/var/tmp/.cache_<hex> on Linux/macOS, %TEMP%\dotnet_diag_<hex>.exe on Windows) and are launched as detached background processes so that killing the parent Node.js process does not stop the infection. A fake "analytics" marker file throttles re-infection with an approximately six-hour cooldown.
The Linux payload is UPX-packed and statically linked; the macOS payload is a universal (Intel + Apple Silicon) binary that checks for debuggers (lldb, debugserver, dtrace, frida), Wireshark, VMware artifacts, and low physical memory before proceeding, and persists via a disguised LaunchAgent (~/Library/LaunchAgents/com.apple.windowserver.helper.plist). Infrastructure strings in the macOS binary are single-byte XOR-encoded (key 0x9c) and decode to additional attacker-controlled hosts referencing Russian financial institutions (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), used by researchers as decoy/health-check traffic and as the basis for a moderate-confidence Russian attribution. Separately, Sonatype documented a Windows-specific second stage that patches Event Tracing for Windows (ETW) and tampers with the Antimalware Scan Interface (AMSI), establishes persistence via a Registry Run key and a scheduled task, and reflectively loads an encrypted payload in memory. The Linux payload is suspected — per a researcher cited by OpenSourceMalware, not yet independently confirmed — of ultimately deploying a Sliver implant, the open-source red-team C2 framework originally built by Bishop Fox.
Researchers link WEL1DROPPER/Flooding Dropper to the earlier "Moika" campaign (250+ npm packages published April-May 2026 via oob.moika.tech) based on shared tradecraft: "oob"-named infrastructure, fake telemetry camouflage, and similar kill-switch/rate-limiting mechanisms. The attacker publishes through many disposable, apparently automated npm accounts rather than one prolific publisher, which frustrates simple account-based takedown.
Target sectors: technology, software development, financial services
Target regions: Global
Timeline
- The tradecraft-linked "Moika" campaign publishes 250+ malicious npm packages (April-May 2026) using 'oob'-named C2 infrastructure (oob.moika.tech), fake telemetry camouflage, and kill-switch mechanisms later reused in WEL1DROPPER.
- A 48-hour surge of AI-slopsquatted npm package publications begins, later reported by researchers as 700+ malicious packages.
- Sonatype Research Labs discloses the campaign, tracked internally as sonatype-2026-005660 ("Flooding Dropper"), reporting roughly 846-850 malicious npm components using 'bigops'/'bnpl' naming patterns and 35.x.y version ranges.
- OpenSourceMalware analyst Paul McCarty publishes a detailed technical writeup naming the downloader WEL1DROPPER, documenting the checkout-mobile-bnpl package, C2 infrastructure, and XOR-decoded Russian financial-institution decoy strings.
- The Hacker News and other outlets report nearly 800 malicious npm packages delivering a cross-platform RAT/infostealer, adding Windows-specific ETW-patching and AMSI-tampering details.
- GBHackers reports the malicious-package count has grown past 1,000, with the campaign attributed to a suspected Russian actor with moderate confidence and a suspected Sliver implant as the final Linux payload.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195.001, T1059.007, T1204.002, T1027, T1622, T1497.001, T1685, T1036.005, T1543.001, T1547.001
