A cluster of almost 800 malicious packages has been uploaded to the npm registry as part of a new campaign that delivers cross-platform malware to Windows, Mac, and Linux systems, according to a report published by OpenSourceMalware and tracked by Sonatype. The packages use artificially generated typo-squatting names and deliver a powerful remote access trojan and information-stealing payload, researcher Paul McCarty noted. Unlike typical npm supply chain attacks that rely on automated installation hooks, these packages instead instruct developers through README files to manually load them using the require() function.

The attack unfolds through a downloader called WEL1DROPPER, which identifies the host system's operating system and processor architecture before retrieving a matching payload from one of three Cloudflare Workers domains. If HTTPS downloads fail, the malware switches to platform-specific domains and uses DNS TXT records to obtain next-stage code from the domain wel1[.]ru, with separate subdomains configured for Linux x64, Linux ARM64, macOS, and Windows systems. The malware requests a TXT record to determine the number of payload chunks—accepting values between 1 and 2,000—then retrieves numbered records that are joined together and Base64-decoded into executable code. The final payload is written to a temporary folder and executed using /bin/sh on Unix-based systems or cmd.exe on Windows.

The Windows version takes steps to patch Event Tracing for Windows and Antimalware Scan Interface to interfere with monitoring, checks for sandboxes and virtual environments, establishes persistence through a Registry Run key and scheduled task, and downloads an encrypted payload before execution, according to Sonatype, which tracks the campaign as Flooding Dropper. The macOS infection performs similar actions to detect debuggers and analysis artifacts before retrieving a compatible payload from a remote server, setting up persistence using a LaunchAgent, and launching the executable in a detached process. The Linux sample is an UPX-packed ELF binary configured to download auxiliary payloads from a Cloudflare Worker URL, ultimately deploying Sliver, an open-source command-and-control framework. The packages also contain a file called lib/telemetry.js that "appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review," OpenSourceMalware said.

The presence of domains like tcsbank[.]ru and cloudpayments[.]ru in the macOS payload suggests the campaign may be targeting Russian financial institutions and mobile payments, the report notes. The attack is suspected to be an evolution of a dependency confusion campaign called Moika that appeared in April and saw over 250 packages published to npm to steal environment information and deliver operating system-specific second-stage payloads. Palo Alto Networks Unit 42 separately documented multiple campaigns targeting npm and PyPI, including 10 npm packages that download an obfuscated cryptocurrency stealer and remote access trojan, as well as malicious packages capable of cloud credential theft, EtherHiding blockchain-based command-and-control droppers, Solana wallet key theft via Telegram, .env file secret exfiltration, and Discord token theft. Unit 42 also observed threat actors using Google Chrome extensions marketed as game emulators, password managers, and productivity tools to turn browsers into web crawling proxies, with crawl commands received remotely via persistent WebSocket connections and content converted to Markdown in the background before being sent to remote cloud backends. The practice of embedding commercial web bandwidth-sharing SDKs into browser extensions represents a new vector for monetizing user systems without explicit consent, even when some extensions disclose the behavior in privacy policies. Organizations relying on open-source package repositories face mounting pressure to implement verification protocols beyond automated scanning, as attackers increasingly disguise malicious code within plausible-looking telemetry and analytics libraries.