Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A new campaign has been discovered publishing nearly 800 malicious packages to the npm registry, designed to deliver a cross-platform remote access trojan (RAT) and infostealer to Windows, macOS, and Linux systems. The packages use AI-generated typo-squatting names and instruct developers to load them with require(), triggering a downloader named WEL1DROPPER.

WEL1DROPPER identifies the host OS and CPU architecture, then fetches a compatible payload from Cloudflare Workers domains or via DNS TXT records from wel1[.]ru. The final payload is executed using /bin/sh or cmd.exe. Sonatype tracks the campaign as ‘Flooding Dropper’ and reports that the Windows version patches ETW and AMSI, checks for sandboxes, establishes persistence via Registry Run key and scheduled tasks, and downloads an encrypted payload. The macOS variant performs similar anti-analysis checks and uses a LaunchAgent for persistence. The Linux sample is an UPX-packed ELF that deploys the Sliver C2 framework.

The packages also include a fake telemetry SDK to evade detection. Indicators suggest targeting of Russian financial institutions. The campaign is suspected to be an evolution of the ‘Moika’ dependency confusion campaign. Additionally, Palo Alto Networks Unit 42 documented other npm and PyPI attacks, including cryptocurrency stealers and RATs, as well as malicious Chrome extensions that turn browsers into web crawling proxies.