Full Report
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload," OpenSourceMalware researcher Paul
Analysis Summary
# Tool/Technique: WEL1DROPPER (Flooding Dropper Campaign)
## Overview
This is a cross-platform supply chain attack involving nearly 800 malicious npm packages. The campaign uses "AI slop-squatting" (randomly generated or AI-mimicking typosquatting) to distribute a sophisticated downloader known as **WEL1DROPPER**, which ultimately deploys Remote Access Trojans (RATs) and information stealers like Sliver.
## Technical Details
- **Type:** Malware Downloader / Dropper
- **Platform:** Windows, macOS, Linux (x64 and ARM64)
- **Capabilities:** OS/Architecture fingerprinting, multi-stage delivery (HTTPS/DNS), sandbox evasion, persistence, and C2 framework deployment.
- **First Seen:** August 2026 (Reported)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0002 - Execution]**
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- [T1543.001 - Create or Modify System Process: Launch Agent]
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools (AMSI/ETW Patching)]
- [T1497 - Virtualization/Sandbox Evasion]
- [T1027.002 - Obfuscation: Software Packing (UPX)]
- **[TA0011 - Command and Control]**
- [T1071.004 - Application Layer Protocol: DNS (TXT Records)]
## Functionality
### Core Capabilities
- **Environmental Fingerprinting:** Determines the host OS and CPU architecture to fetch the specific compatible binary.
- **Hybrid Delivery Mechanism:** Primary payload delivery via HTTPS (Cloudflare Workers); fallback delivery via DNS TXT record fragmentation (joining up to 2,000 chunks).
- **Detached Execution:** Launches the final stage as a separate process to decouple it from the initial npm execution environment.
### Advanced Features
- **Security Software Interference:** On Windows, it actively patches the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) to blind security products.
- **Anti-Analysis:** Includes specific checks for debuggers, virtual environments, and sandboxes.
- **Stealth via Noise:** Includes a "telemetry.js" file that mimics a legitimate SDK to hide malicious logic within what looks like routine profiling code.
## Indicators of Compromise
- **File Names:** `WEL1DROPPER`, `update_win.exe`, `beacon_mac.bin`, `telemetry.js`
- **Registry Keys:** `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` (Used for persistence)
- **Network Indicators (Defanged):**
- oob-worker.cf103-070.workers[.]dev
- oob-worker.cf102-baf.workers[.]dev
- oob-worker.cf99-9b3.workers[.]dev
- wel1[.]ru (DNS TXT source)
- sdk.dl.wel1[.]ru
- ext.dl.wel1[.]ru
- pkg.dl.wel1[.]ru
- net.dl.wel1[.]ru
- **Behavioral Indicators:** Unexpected `cmd.exe` or `/bin/sh` calls originating from npm/node processes; high volume of DNS TXT queries to a single domain.
## Associated Threat Actors
- **Moika:** Suspected to be an evolution of the Moika dependency confusion campaign (April 2026).
- **Targeting:** Domain artifacts suggest a focus on Russian financial institutions and mobile payment providers.
## Detection Methods
- **Signature-based:** Detect UPX-packed ELF binaries in temp directories and identification of "telemetry.js" downloader logic.
- **Behavioral:** Monitor for `node.exe` or `npm` attempting to modify Registry Run keys or creating scheduled tasks. Monitor for AMSI/ETW patching activities.
- **DNS Monitoring:** Alert on anomalous TXT record requests (high frequency/volume) originating from developer workstations.
## Mitigation Strategies
- **Supply Chain Security:** Use lockfiles (`package-lock.json`) and verify package integrity.
- **Dependency Review:** Inspect READMEs and installation instructions; be wary of packages requiring manual `require()` calls instead of standard lifecycle hooks.
- **Environment Hardening:** Restrict developer machine permissions to prevent the creation of persistence mechanisms (LaunchAgents, Scheduled Tasks).
- **Egress Filtering:** Block access to unauthorized Cloudflare Workers or unknown `.ru` domains from production and development environments.
## Related Tools/Techniques
- **Sliver:** The open-source C2 framework used as a final stage payload.
- **Dependency Confusion:** The underlying technique used to trick developers into installing malicious versions of internal or non-existent packages.