# TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bank

> An unattributed operator published nearly 1,000 malicious npm/PyPI packages impersonating Tinkoff Bank's (T-Bank) private package namespace, using an import-time JavaScript trigger, an environment-aware loader that checks for the bank's internal Nexus repository before beaconing, and DNS TXT-record staging to reassemble a native second-stage that deploys a Sliver C2 implant. Independently corroborated by Sonatype ("Flooding Dropper", 846 packages) and OpenSourceMalware ("WEL1DROPPER", 700+ packages), the operator resumed publishing within ~25 hours of an npm takedown and had staging infrastructure serving valid executables as of 2026-08-03; no confirmed compromise is evidenced.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1977
- **ID:** TL-2026-1977
- **Severity:** HIGH (CVSS 8.7)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TXTBOOK is a dependency-confusion supply-chain campaign first tracked on PyPI in July 2026 and expanded to npm the same month, ultimately publishing 993 malicious npm package names (1,156 versions across 80+ namespace families, per CloudSEK's corpus sweep) that impersonate the private npm/PyPI namespace of Tinkoff Bank (T-Bank) and its CloudPayments processor. Independent researchers tracked overlapping or the same activity under different names: Sonatype documented 846 packages as "Flooding Dropper" (advisory sonatype-2026-005660, CVSS 8.7, CWE-506), and OpenSourceMalware researcher Paul McCarty documented 700+ packages as "WEL1DROPPER", linking it to an April/May 2026 precursor campaign called "Moika" (250+ packages) on shared tradecraft (oob-prefixed infrastructure naming, fake telemetry camouflage, comparable kill-switch mechanisms).

The package names impersonate internal T-Bank service paths across namespace families including bnpl-* (156, BNPL product), dolyame-* (133, consumer BNPL brand), devplatform-* (108), bigops-* (97), boxy-* (70), checkout-* (61), claims-* (41), tinkoff-* (38), statist-browser-typed-client-* (54, analytics clients), and bpm-foundation-* (25), plus a secondary cluster of four online-betting names. Rather than relying on npm lifecycle scripts (preinstall/postinstall), the newest generation of packages executes at import time — a README instructs the victim to run `require("checkout-mobile-bnpl")` or similar, and that call alone starts the infection chain, evading tooling that only inspects install-time hooks.

The first-stage JavaScript loader fingerprints host OS/architecture, attempts an HTTPS download from hardcoded Cloudflare Workers hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev), and falls back to DNS TXT-record staging under wel1.ru if all three fail: it queries c.wel1.ru for a chunk count (1-2,000), then requests numbered TXT records (0.<domain>, 1.<domain>, ...) that reassemble into a Base64-encoded native binary. Per CloudSEK, the loader stores its hostname table obfuscated with a single-byte XOR key that differs per build, with fragments reassembled at runtime to defeat static keyword matching. Before contacting attacker infrastructure, the loader resolves T-Bank's internal Nexus artifact repository (nexus.tcsbank.ru), an internal Linux package repository, and CloudPayments' alerting endpoint (cloudpayments.ru) — proceeding to beacon only if these victim-side hosts answer, confirming execution inside the target's network before revealing itself.

Second-stage payloads are platform-specific: Windows binaries patch ETW and AMSI, check for debuggers/VMs/sandboxes/security products, establish persistence via a Registry Run key and a scheduled task, and reflectively load an encrypted payload fetched from a `/pkg/update_win.exe`-style path; a Linux x86-64 payload (UPX 3.96-packed, statically linked, SHA-256 7e486657f30594afda379b97030252a09a19fe8055e25c9e371544f59bd8e9e3) delivers a Sliver implant; and a macOS Universal payload (SHA-256 c214746c74cae8ece8bdaf69aa05da4db6ce013f9e77452d1eed1a002fd9ba00) performs additional anti-analysis checks and installs a fake LaunchAgent at ~/Library/LaunchAgents/com.apple.windowserver.helper.plist. CloudSEK additionally documents defeat of analysis-environment countermeasures (spoofed Dell OptiPlex SMBIOS strings, disabled hypervisor CPU flags, populated consumer-SSD registry disk-enum keys, full hardware virtualization, a pre-trusted lab CA).

The recovered Sliver implant is a statically linked, obfuscated Go binary encrypted with age (X25519 + ChaCha20-Poly1305) rather than Sliver's native scheme, with every server response authenticated via an Ed25519 minisign signature and traffic randomly wrapped in one of five encoders (Base64, Gzip, Hex, English-word-based, PNG steganographic). CloudSEK attributes two distinct operator servers by minisign key ID — Server A (262CA2380CC0AB31, Windows x64 + Linux ARM64 builds) and Server B (68BAEB7614479037, Linux x64 builds) — both fronted by the same Cloudflare Workers estate. CloudSEK recovered 79 of 82 Sliver command types from reflection metadata, including in-process .NET assembly execution, DLL sideloading/spawning, native and WebAssembly extension loading, five token/privilege-escalation primitives, a full SSH client with Kerberos support for constrained-delegation abuse, SOCKS proxying, port forwarding, and WireGuard tunneling.

153 disposable publisher accounts were recovered, all matching a 12-character alphanumeric username pattern (^[a-z0-9]{12}$) registered to web-library.net (mailbox equals username), collectively covering 178 of the 993 recovered package names — the remainder having already been reassigned to npm's security-holder account after takedown. The operator demonstrated resilience: npm removed nine of the first ten detected package names on 2026-08-01, and publishing resumed within ~25 hours (2026-08-02) using freshly disposable accounts; staging infrastructure was observed serving a valid native executable as of 2026-08-03. No source reports a confirmed compromise of T-Bank/Tinkoff systems. Attribution is unconfirmed: OpenSourceMalware assesses a Russian actor with moderate confidence based on the .ru C2 domain (wel1.ru) and embedded references to Russian financial institutions (tcsbank.ru, cloudpayments.ru) used as decoy/health-check traffic — an unusual choice if the actor is domestically Russian, which the sources do not resolve.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1574 Hijack Execution Flow
- T1082 System Information Discovery
- T1558 Steal or Forge Kerberos Tickets
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1573 Encrypted Channel

## Sources

- [TXTBOOK: A Supply Chain Heist Rehearsed in Public](https://www.cloudsek.com/blog/txtbook-a-supply-chain-heist-rehearsed-in-public)
- [Flooding Dropper Hits npm With 850 Malicious Packages](https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages)
- [Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages](https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign)
- [Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer](https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html)
- [Flooding Dropper Hits npm With 850 Malicious Packages](https://securityboulevard.com/2026/08/flooding-dropper-hits-npm-with-850-malicious-packages/)
- [Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages](https://gbhackers.com/russian-hackers-use-ai-slopsquatting/)
- ['Flooding Dropper' Is Hitting npm With a Tidal Wave of Malicious Packages](https://devops.com/flooding-dropper-is-hitting-npm-with-a-tidal-wave-of-malicious-packages/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1977