# Suspected Russian Actor Uses AI Slopsquatting to Publish 1,000+ Malicious npm Packages (WEL1DROPPER / "Flooding Dropper")

> A suspected Russian threat actor, attributed with moderate confidence, is registering AI-hallucinated npm package names ("AI slopsquatting") that coding assistants tend to suggest to developers. The campaign — tracked as WEL1DROPPER by OpenSourceMalware and as "Flooding Dropper" (sonatype-2026-005660) by Sonatype — grew from 700+ to 1,000+ malicious packages within 48 hours starting August 4-5, 2026, infecting Windows, macOS, and Linux hosts via a single require() call with no install scripts, and delivering a suspected Sliver C2 implant on Linux.

- **Published:** 2026-08-09T00:00:00Z
- **Last reviewed:** 2026-08-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1951
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-wel1dropper-ai-slopsquatting-npm-tl-2026-1951.webp?v=c54661c2 (Threadlinqs threat intel: WEL1DROPPER 1,000+ Malicious npm Slopsquatting Packages (TL-2026-1951) — High severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-1951
- **Severity:** HIGH (CVSS 8.7)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Beginning around August 4-5, 2026, researchers at Sonatype Research Labs and independent analyst Paul McCarty (OpenSourceMalware) independently identified a fast-moving npm supply-chain campaign that published hundreds of malicious packages within 48 hours, reaching roughly 788-850 packages by August 5-6 and exceeding 1,000 by August 8. Sonatype tracks the activity internally as sonatype-2026-005660 ("Flooding Dropper"); OpenSourceMalware named the downloader WEL1DROPPER.

The campaign is notable for its infection vector: rather than abusing npm's preinstall/postinstall lifecycle hooks, the malicious packages (e.g. checkout-mobile-bnpl@35.6.9, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery) masquerade as small mobile/BNPL SDKs with plausible init(), version(), and configure() methods. Their README instructs a developer to simply require() the package, which auto-executes a bundled _helpers.js first-stage loader. This is the technique researchers are calling "AI slopsquatting": the package names are AI-hallucination-style compound names of the kind coding assistants have been shown to confidently suggest even though they don't exist, rather than classic typo-variants of real packages.

Once loaded, the first-stage JavaScript fingerprints host OS and CPU architecture and fetches a matching second-stage binary (Linux x64/ARM64 ELF, universal macOS Mach-O, or Windows PE) from one of several rotating Cloudflare Workers hosts (oob-worker*.workers.dev, package-proxy.cf*oobworker.workers.dev), falling back to reconstructing the payload from Base64-encoded DNS TXT record chunks served under the wel1.ru domain if HTTPS delivery is blocked. Dropped binaries use disguised filenames (/var/tmp/.cache_<hex> on Linux/macOS, %TEMP%\dotnet_diag_<hex>.exe on Windows) and are launched as detached background processes so that killing the parent Node.js process does not stop the infection. A fake "analytics" marker file throttles re-infection with an approximately six-hour cooldown.

The Linux payload is UPX-packed and statically linked; the macOS payload is a universal (Intel + Apple Silicon) binary that checks for debuggers (lldb, debugserver, dtrace, frida), Wireshark, VMware artifacts, and low physical memory before proceeding, and persists via a disguised LaunchAgent (~/Library/LaunchAgents/com.apple.windowserver.helper.plist). Infrastructure strings in the macOS binary are single-byte XOR-encoded (key 0x9c) and decode to additional attacker-controlled hosts referencing Russian financial institutions (nexus.tcsbank.ru, repo-linux.tcsbank.ru, alertmanager.cloudpayments.ru), used by researchers as decoy/health-check traffic and as the basis for a moderate-confidence Russian attribution. Separately, Sonatype documented a Windows-specific second stage that patches Event Tracing for Windows (ETW) and tampers with the Antimalware Scan Interface (AMSI), establishes persistence via a Registry Run key and a scheduled task, and reflectively loads an encrypted payload in memory. The Linux payload is suspected — per a researcher cited by OpenSourceMalware, not yet independently confirmed — of ultimately deploying a Sliver implant, the open-source red-team C2 framework originally built by Bishop Fox.

Researchers link WEL1DROPPER/Flooding Dropper to the earlier "Moika" campaign (250+ npm packages published April-May 2026 via oob.moika.tech) based on shared tradecraft: "oob"-named infrastructure, fake telemetry camouflage, and similar kill-switch/rate-limiting mechanisms. The attacker publishes through many disposable, apparently automated npm accounts rather than one prolific publisher, which frustrates simple account-based takedown.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1027 Obfuscated Files or Information
- T1622 Debugger Evasion
- T1497.001 System Checks
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1543.001 Launch Agent
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1071.004 DNS
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1082 System Information Discovery
- T1583.006 Web Services
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WEL1DROPPER Malicious npm Package require() Execution** (`TL-2026-1951-SPL-001`)

Detects a Node.js/npm process whose command line or dropped-file hash matches a known WEL1DROPPER/Flooding Dropper AI-slopsquatted package (checkout-mobile-bnpl, bigops-backend, dolyame-boxy-desktop-bnpl-card-gallery) or its first-stage loader (_helpers.js) / entrypoint (index.js) SHA-256, indicating the package's require() call has auto-executed with no install script needed.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1059.007, T1204.002, T1036.005
- **Data sources:** sysmon, windows_security, npm_registry_logs, edr_process_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ParentImage=lower(ParentImage)
| where ParentImage="*\\node.exe" OR ParentImage="*/node" OR ParentImage="*\\npm.cmd" OR ParentImage="*/npm"
| where match(CommandLine, "(?i)(checkout-mobile-bnpl|bigops-backend|dolyame-boxy-desktop-bnpl-card-gallery)") OR match(Hashes, "(?i)(94EF6B1C4A9D31F78F446D053048BCEF34FD88F4436A1A46F7F777A9E9C83A29|B74C5675725911C62091BDF40714DF760CC2AF7A88360D21065F4E1C878AA8F0)")
| table _time, host, User, ParentImage, Image, CommandLine, Hashes
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe","node","npm.cmd","npm")
| where ProcessCommandLine has_any ("checkout-mobile-bnpl","bigops-backend","dolyame-boxy-desktop-bnpl-card-gallery")
   or SHA256 in~ ("94ef6b1c4a9d31f78f446d053048bcef34fd88f4436a1a46f7f777a9e9c83a29","b74c5675725911c62091bdf40714df760cc2af7a88360d21065f4e1c878aa8f0")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: WEL1DROPPER Malicious npm Package require() Execution
id: 7b2f1a44-3e6d-4a1a-9d2b-1c4e7f0a9b21
status: experimental
description: Detects Node.js/npm process execution referencing known WEL1DROPPER/Flooding Dropper malicious npm package names or first-stage loader (_helpers.js) file hashes, indicating the AI-slopsquatted package's require() call has auto-executed.
references:
    - https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign
    - https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-09
tags:
    - attack.initial-access
    - attack.t1195.001
    - attack.execution
    - attack.t1059.007
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_process:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
    selection_pkg:
        CommandLine|contains:
            - 'checkout-mobile-bnpl'
            - 'bigops-backend'
            - 'dolyame-boxy-desktop-bnpl-card-gallery'
    selection_hash:
        Hashes|contains:
            - '94EF6B1C4A9D31F78F446D053048BCEF34FD88F4436A1A46F7F777A9E9C83A29'
            - 'B74C5675725911C62091BDF40714DF760CC2AF7A88360D21065F4E1C878AA8F0'
    condition: selection_process and (selection_pkg or selection_hash)
falsepositives:
    - Legitimate internal package with a coincidentally similar name (verify against npm registry ownership)
    - Security researchers intentionally installing the sample in an isolated sandbox for analysis
level: critical
```

**Known false positives:**

- Legitimate internal package with a coincidentally similar name — verify npm registry ownership and publisher history before treating as malicious
- Security researchers intentionally installing the sample in an isolated sandbox for analysis

**Tuning notes:** Extend the CommandLine/package-name match list as new WEL1DROPPER-style package names are identified via the Sonatype/OpenSourceMalware trackers; add file-hash IOC updates for _helpers.js/index.js variants as new samples surface.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- WEL1DROPPER Malicious npm Package require() Execution (locked: unlock with TL Creds)
- WEL1DROPPER Cross-Platform Persistence and Defense Evasion (locked: unlock with TL Creds)
- WEL1DROPPER / Sliver C2 Beacon to Known Campaign Infrastructure (locked: unlock with TL Creds)
- WEL1DROPPER Malicious npm Package require() Execution (locked: unlock with TL Creds)
- WEL1DROPPER Cross-Platform Persistence and Defense Evasion (locked: unlock with TL Creds)
- WEL1DROPPER / Sliver C2 Beacon to Known Campaign Infrastructure (locked: unlock with TL Creds)
- WEL1DROPPER Cross-Platform Persistence and Defense Evasion (locked: unlock with TL Creds)
- WEL1DROPPER / Sliver C2 Beacon to Known Campaign Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- Domain: `wel1[.]ru`
- File hash: `0fc30f82e1fa5e51a6c0c43f3ed7f13592ea731cb331e43a4d085df60a4db8b6`
- Domain: `oob-worker[.]cf103-070[.]workers[.]dev`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages](https://gbhackers.com/russian-hackers-use-ai-slopsquatting/)
- [Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages](https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign)
- [Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer](https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html)
- [Flooding Dropper Hits npm With 850 Malicious Packages](https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages)
- [Russian AI Slopsquatting Campaign Floods npm With Malicious Packages Targeting Developers](https://cyberpress.org/russian-ai-slopsquatting-campaign-floods-npm/)
- [Flooding Dropper Campaign Seeds 850 Malicious npm Packages](https://mallory.ai/stories/019fd3c4-6b8d-7aa2-9137-cf1926c7d625)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1951